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Series Editor’s Foreword 


This collective volume is the fruit of a “strategic analysis”, a research methodology 
developed by FonCSI that brings together academics and practitioners for inquiry, 
debate, and anticipation. A strategic analysis starts with a challenge, a conceptual or 
practical knot identified by FonCSI’s partners from industry and the regulatory world. 
The question is debated with representatives from our partners, alongside a small 
group of safety experts, who explore work from various scientific disciplines that 
can contribute to untwining the knot. This book results from this exploratory process; 
it presents the contributions of international experts who were invited to explain and 
confront their viewpoints during a two-day residential seminar organized by FonCSI 
in 2022 on “the articulation between compliance and initiative in safety manage- 
ment”. This latter phrase was FonCSI’s effort to translate into English a conceptual 
puzzle that is well known in the French-speaking safety community, as the tension 
between «sécurité réglée» (literally “rule-based safety”, or the avoidance of accidents 
through careful system design and compliance with safe work procedures) on the 
one hand, and «sécurité gérée» (literally “managed safety”, the presence of frontline 
expertise which can competently handle unexpected situations). While well known 
by both the academic and practitioner community in France, this terminology is less 
familiar elsewhere, though the distinction between “work-as-imagined” and “work- 
as-done” is increasingly recognized outside the resilience engineering community 
where it first emerged. 

Our framing of this topic aims to include in its scope the related trade-offs between 
anticipation and resilience (following the pioneering work of Aaron Wildavsky, who 
highlighted the difference in mindset between these two strategies for coping with 
possible hazards); between centralization and decentralization of decision-making 
related to safety management; and between the emphasis placed on situated front- 
line expertise and that on the standardization of safety management activities. It 
aims to encompass concepts developed by a range of scientific disciplines, from the 
pioneering work of French-speaking ergonomists such as Jean-Marie Faverge and 
Jacques Leplat from the 1950s concerning the active role that sharp-end workers 
play in compensating for imperfections in equipment, procedures, and other aspects 
of system design; to the cognitive engineering work developed in particular around 
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Jens Rasmussen from the 1970s, emphasizing the ability of experienced operators to 
avoid accidents by understanding and compensating for system deficiencies; to the 
work of the “high-reliability organizations” scholars in the 1980s who recognized 
the importance of maintaining systems’ adaptive capacity by maintaining a degree 
of “organizational slack”, even at the expense of everyday efficiency; the influential 
work of James Reason aiming to understand human error mechanisms; and more 
recently the well-connected and articulate “resilience engineering” community. 

This volume brings together these strands of research on organizational design, 
professional autonomy, organizational rule violations, resilience, and adaptation, 
in order to improve our understanding of the articulation between compliance and 
“intelligent application” of rules and procedures. While most work on this topic has 
concerned the compliance and adaptive behaviors of frontline workers, the contribu- 
tions in this volume adopt a systems perspective and a meso- and macro viewpoint on 
this question, in particular examining the work of managers and including interorga- 
nizational issues in the scope. The introductory chapter, written by Jean-Christophe 
Le Coze, a member of the strategic analysis group, describes the importance of the 
historical and organizational context to the tension between rules and autonomy in 
safety. We hope the ideas presented help think about how to build safety capacity 
and face the challenges of a rapidly changing world. 


June 2023 Eric Marsden 
FonCSI 
Toulouse, France 
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Chapter 1 A) 
Contextualizing (Safety) Rules get 


Jean-Christophe Le Coze 


Abstract This introductory chapter combines several dimensions which are meant 
to help frame a complex topic representing a very rich diversity of situations across 
industries, countries, and epochs. The idea is to sensitize readers to several aspects 
associated with the topic of rules and autonomy in the domain of safety, and of this 
book. Its aim is to emphasize the importance of contexts when it comes to (safety) 
rules. Contexts refer to organizations, to industries, to risks, to histories, to practices, 
to situations, and to countries. Three sections develop the importance of context: 
(1) The advent of safety rules as an established narrative, (2) There is more than 
rules in safety, and (3) Historical trends ... a bureaucratization of safety? The last 
section presents the chapters of this book, grouped in three categories, (1) Finding 
or losing the balance; (2) The role, position, and influence of middle-managers and 
top management, finally; (3) When autonomy, initiative, and resilience take the lead. 


Keywords Rules : Autonomy : Safety - System - Work : Organization : 
Regulation » Context 


1.1 Introduction 


This chapter suggests several dimensions which are meant to help frame a complex 
topic representing a very rich diversity of situations across industries, countries, and 
epochs. The idea is to sensitize readers to several aspects associated with the topic 
of rules and autonomy in the domain of safety, and of this book. It implies several 
simplifications. Such choices strongly limit nuances, but the aim is to emphasize the 
importance of contexts when it comes to (safety) rules. Contexts refer to organiza- 
tions, to industries, to risks, to histories, to practices, to situations, and to countries. 
Nuances would require far more space but would also divert from the general idea of 
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this text which is to provide elements of analysis and perspective to situate several 
issues associated with the topic of this book. 

The result is a relatively short but dense text which relies on a mix of conceptual 
and empirical research in a diversity of traditions in the field of safety and beyond. 
In this introductory chapter, three sections develop the importance of context: the 
advent of safety rules as an established narrative (1), there is more than rules in 
safety (2), and historical trends ... a bureaucratization of safety (3). The last section 
presents the chapters of this book, in three categories, finding or losing the balance; 
the role, position, and influence of middle-managers and top management, finally; 
when autonomy, initiative, and resilience take the lead. 


1.2 Rules in Context (1): The Advent of (Safety) Rules 
as an Established Narrative 


The principle that rules exist to protect workers from unsafe conditions in a capitalist 
era has a long history. The horrific working conditions depicted in the industrial 
revolution of the nineteenth century remind us of how much progress has been made 
over the past two centuries in many countries (starting with child labor). The notion of 
safety rules is thus embedded in the idea, and a long history, of making sure to protect 
workers from harms and hazards, limiting the risks, for instance, of falls, anoxia, 
electric shocks or crushed limbs when respectively working from height, in confined 
space, close to live electric cables or close to moving mechanical parts. Ideally, 
system design should prevent people from exposure to hazards, yet rules understood 
as practices (not “behaviors”) are also necessary to make sure that workers limit their 
exposition to hazards when safer designs are not possible. 

The law has progressively evolved to make sure that such rules are in place and 
enforced to prevent harming workers. The idea that the expectations should be set 
by states is also particularly ingrained in the struggle to improve workers’ safety 
(the same applies to product safety, road safety, or fire safety). So, the idea that the 
absence of safety rules or the absence of their implementation (when existing) is a 
problem because it exposes workers to hazards, is a strong legacy of the past, and of 
its successes. History shows us that countries which tighten, through laws and state 
enforcement of rules their expectations in terms of safety, obtain results (a broad 
comparison between countries across the world makes it clear). 

One reason is that the forces of capitalism are not compatible with safety if 
not counteracted by strong requirements imposed, from within or from outside, to 
organizations of all sorts. These requirements are translated in rules. To work safely, 
hazards need to be identified (which is itself a rule), then safety rules designed 
to prevent and to mitigate these hazards, then complied with in practice. This is 
potentially constraining for businesses because such rules can slow down work, can 
make products or services more expensive. Rules in terms of design can cost extra 
money. Therefore, and seen from this perspective, an accident in the workplace is 
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very often associated with the lack of sufficient attention granted by employers to 
the safety of their employees, and the design, implementation, and enforcement of 
adequate rules. It is a discourse which makes sense considering many industries and 
countries’ experiences in history. 

In other domains than workers’ safety, with the advent of new modes of transporta- 
tion during the industrial revolution for instance, starting with trains and steamships, 
safety has also been linked to the importance of rules. The first severe train crash 
in France in Meudon in 1842, caused a fire which killed fifty-five passengers. The 
doors were locked by the controller after departure, and many could not escape their 
carriages, increasing the death toll. The rule was then changed. The doors were no 
longer locked after this event. The Titanic sank in 1912 and didn’t have sufficient 
lifeboats to evacuate its passengers. It had 20 lifeboats, half of what was needed to 
save everybody on board. The design rule changed afterward to make sure enough 
lifeboats were available for all passengers of steamships. 

Because of the safety risks to workers and passengers, rules became central to 
the achievement of safe operations in such transport systems, not to mention design 
improvements much later in road safety, from safety belts to airbags and other features 
implemented in cars’ designs to secure driving, including of course design of infras- 
tructures (roads, tunnels, bridges) and rules to regulate traffic and drivers’ practices. 
There would be a list of many other cases in which rules (of design or of prac- 
tices) evolved to improve the safety of systems as they matured (mining, explosives’ 
production, or transport of hazardous material for instance). But the advent of more 
complex and larger technical systems in the second half of the twentieth century is 
another good example to show the importance of rules (of design and of practice) to 
reach high levels of safety. 

Nuclear power plants, ballistic missiles, space exploration, nuclear weapons or 
submarines, civil aviation, chemical plants, pipelines, and refineries are many other 
examples in which safety had to be translated in rules (of design, of practices) to 
maintain operations and activities under control. It is difficult to imagine obtaining 
such levels of reliability and safety without the existence of rules, standards, proce- 
dures and of compliance with them. And regulatory systems also played a strong role 
in many of these cases. For some of these systems, they are protected from the forces 
of markets and capitalism (mostly in the military domains), but many are not. This 
view of industries in general (e.g., construction, factories, warehouses) and safety- 
critical systems (e.g., nuclear, oil and gas, aviation, chemical, railways) therefore 
constitutes a well-established discourse. From this macro perspective of the history 
of safety, rules matter. 

It is a narrative which makes a lot of sense considering what we know and what to 
recommend for improvements. However, this discourse also needs a certain degree 
of refinement. First, there is always room for improvement. For instance, in France, 
a country in which safety in the workplace has been incorporated in the law for 
decades, two people died at work every week in 2021 (more than 700 deaths) in 
industries and services (this figure excludes workers killed when traveling to work 
or employees committing suicides). This situation is obviously unsatisfactory and 
reflects profound issues. And, in highly regulated safety-critical systems, accidents 
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and disasters still occur from time to time, also indicating the limits of safety. In 
France, if one considers as an indication the number of casualties, the last major 
event in the chemical industry was in 2001, in Toulouse; the last major aircraft crash 
happened in 2009 between Rio and Paris, and the last major derailments were in 
2013 in Brétigny and 2015 in Eckwersheim. 

Second, a point to be developed next, rules need to be strongly contextualized to 
understand how safety is really produced, and this tends to bring another discourse to 
the one sketched above, not replacing it, but refining it. Safety can only be achieved 
through workers’ expertise for instance, but also when the proper working conditions 
are created for rules to be implemented, which is, in both cases, an organizational 
outcome. Rules also need to be further contextualized from a historical point of view, 
to incorporate trends in work, labor relations, organizations, businesses, markets, 
and states over several decades. To contextualize rules, the contribution of many 
different disciplines or research traditions is needed. Law, sociology, psychology, 
social psychology, cognitive engineering and ergonomics, political science, and 
management have much to bring to such contextualizing. Indeed, our understanding 
of rules in safety has been tremendously improved over the past decades thanks to 
these traditions, and this book is an addition to this. 


1.3 Rules in Context (2): There Is More Than Rules 
in Safety 


The key problem with rules is simply that work, organizations, and regulations are 
far more complex than what rules can actually reveal about daily activities. There is 
more to work, organizations, and regulations than rules in general. This is the result 
of decades of research. Studying work shows how workers must adapt to circum- 
stances in ways that requires their expertise and judgment. Realities of work often 
create imperfections not accounted for, including imperfection of rules themselves. 
Dilemmas and surprises also challenge the application of (safety) rules. A certain 
degree of autonomy is therefore expected. French ergonomists have long and ethno- 
graphically described the difference between what is defined as “prescribed work” 
and “real work”, translated in English with the notions of “work as done” and “work 
as imagined”. 

Studying organizations shows that bureaucracies, epitomizing the ideal of the 
legal-rational principles of conduct through formal structures (e.g., standardization, 
division of work, lines of authority), also reveal informal realities beyond rules. The 
perfect, clockwork, ideal of organizations based on rules must be complemented by 
what psychologists and sociologists have shown for decades to be a far more complex 
mix of cognitive, informal, relational, social, and political dimensions beyond the 
structure of formal organizations. In this respect, safety risks are not given but 
collectively constructed instead. Rules (of design, of practices) are constructed. And 
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regulation, one important role of the state consisting in producing laws and their 
enforcement through administrative bodies (e.g., inspectorate), is no different. 

These two paragraphs shortly frame broadly some of the key analytical elements 
of several decades of findings in different research traditions in the field of safety, 
such as cognitive system engineering and high-reliability organizing for instance. 
The outcomes of many empirical studies in these traditions show the importance of 
understanding safety beyond a simplistic approach to rules. Ethnographic studies of 
cognition and organizations in safety-critical contexts show the ability to cope with 
complexity (i.e., imperfections of work and organizations, unexpected events), and 
therefore the combination of rules and of a certain degree of autonomy. 

These different research traditions, beyond their intellectual background and the 
way they frame it, using different vocabularies, address the ability to find ways to 
combine anticipation and resilience, centralization and decentralization, compliance 
and initiative, or standards and expertise. The choice of vocabulary can convey differ- 
ences in conceptualization, but the problem is shared by researchers in safety irrespec- 
tively of their disciplinary backgrounds (e.g., sociology, psychology, ergonomics, 
management, political science). However, as already discussed in the introduction 
when contrasting highly regulated organizations (e.g., aviation, nuclear) with other 
industries (e.g., factories, warehouses), but also countries, there are many differences 
in the level of resources and strategies of companies, industries, and states involved 
in managing this combination. 

Centralizing in certain safety-critical systems (e.g., aircraft, nuclear submarines, 
space exploration, nuclear power plants) implies great expenses in training, engi- 
neering, and design to make sure that rules and standards are created with adequate 
support for them to be properly implemented, and to be relevant to the level of risks of 
different tasks and activities. Decentralizing means that a certain degree of autonomy 
is made possible thanks to the adequate level of expertise of the workforce (including 
management) obtained through training, socializing, and professionalization. 

In other words, the quality of the balance between rules and autonomy or central- 
ization and decentralization to manage safety risks is thoroughly an organizational, 
or system one. One cannot understand what happens locally in daily frontline prac- 
tices, in terms of rules and autonomy, independently of the organizational contexts 
and resources involved. Thus, the ability to reflect and to find solutions to problem- 
atic situations met in the field in terms of the balance between rules and autonomy 
is an organizational matter, not a frontline one. Safety-critical systems must manage 
this daily. 

To do so can imply the involvement (preferably before a major event) of an awful 
lot of roles and functions depending on the extent of the problem, from workers, 
supervisors, middle-managers, engineers, and perhaps sometimes also, top managers 
and regulators. What happens at the front line, in the field, depends indeed on a 
wide range of vertical and horizontal coordination, cooperation, negotiation, and 
communication in all kinds of situations in terms of resources, delay, and objectives. 
The ability to calibrate organizations to meet their safety expectations translated in 
rules is a challenge which varies greatly according to domains. 
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For instance, organizations outside of the category of safety-critical systems, with 
different levels of resources, expectations, and requirements, do not have the same 
options. This, of course, does not imply that major events in safety-critical systems do 
not happen. It does not also imply that improvements are not possible in these highly 
regulated, reliable, and safe systems, and that they do not face complex problems 
daily, and risks of degradation in their accomplishments (many cases illustrate this, 
the Boeing 737 Max comes to mind). It does not imply either that other industries 
cannot be successful in safety, and many are. However, the point made is that the 
construction industry, for instance, because of its very distinct (business) model is 
very different from aviation in terms of the combination of rules and autonomy, or 
centralization and decentralization. 

It is therefore important for the topic of rules and autonomy in safety to be 
strongly contextualized when discussed. This issue cannot be approached in the 
same way in the construction industry or in the aviation industry. Different systems, 
different approaches. So, this contextualization of (safety) rules matters, but that is 
not all. Another type of contextualization is needed. It refers to the historical trends 
in work, labor relations, organizations, businesses, markets, and states over the past 
decades which have been now widely commented in the field of safety across research 
traditions, industries, and countries. 


1.4 Rules in Context (3): Historical Trends ... 
a Bureaucratization of Safety? 


While the importance of rules (of design, of practices) in safety are variously estab- 
lished across domains, requirements and expectations are not fixed and have also 
considerably evolved over time too. Three important sources of evolution can be 
identified and briefly discussed. One is the increase of standards. As the economy 
evolved toward extended global markets in the 1980s and 1990s, management stan- 
dards to ensure quality of services and products across contracting companies, certi- 
fied through audits by external parties, proliferated. It created new demands on 
organizations to show to auditors how compliant they were with management stan- 
dards, requiring an important level of paperwork (or increasingly digitalized version). 
Safety followed that trend, to also become a domain framed by management stan- 
dards, certified by auditors, expecting traceability for auditing then certifying, or not, 
companies. 

This transformation implied the recruitment and training of people dedicated to 
such activities of certification inside companies, including safety professionals. It 
also created a new business for certification and consulting companies. This increase 
in standardization was concomitant with evolutions in states’ strategies in terms of 
regulatory approach. A move from the prescriptive, command-and-control philos- 
ophy was replaced by tools with various degrees of self-regulation. The genesis of 
these changes in regulatory regimes led to an increased reliance on the production of 
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internal rules, adapted to their safety risks, to be inspected by authorities. The change 
of regulatory philosophy was not at all the end of rules, but a new way of prescribing 
rules internally for companies, and the need to show how such rules were in place 
for inspectorate to check on them externally. 

Another source of important changes connected to the production of rules in safety 
in the past decades is the outsourcing of many activities in companies which implies 
the production of contracts, and a codified, legal mode of interacting between organi- 
zations, including the topic of safety. For multinationals operating across the world, 
these evolutions (management systems, certification, and audits; self-regulation, 
internal standards, and inspections; externalization and contractual relationships) 
have meant an important investment in the production of safety management systems 
and of a range of categories of rules. This was coined, when it first appeared, the 
development of an audit society, then of a bureaucratization of safety. 

While multinationals are indeed concerned across domains, other organizations, 
smaller ones working as subcontractors for these bigger ones for instance, must cope 
with this increase too. This description is not to say that we discover the issue of red 
tape (the excessive, slow bureaucratic process of submitting decisions to multiple 
authorizations and formalities) but that the bureaucratization of safety addresses the 
problem of a potentially overly bloated, disproportionate level of requirements in 
relation to the safety risks involved. Another dimension of this expansion of rules 
is the lack of consideration, in the context of inflated bureaucratic processes, of 
the complexity that it entails for workers and managers. Moreover, it has become 
subsequently easier (although of course far from new), after an event, to find a rule 
which has been breached. Workers’ autonomy, expertise, and professionalism are 
employed to find ways to cope with a plethora of rules that have become a risk for 
them to manage. 


1.5 A Complex Empirical Question, a Sensitive One 


Diversity and variation in epochs, countries, industries, organizations, practice, situ- 
ations, and systems...the aim of this very sketchy picture, intently so, is to signify the 
need for a very careful, nuanced, and empirical approach to the question of rules and 
autonomy in safety and the importance of contexts. Dedicated studies on safety and 
rules over the years show how researchers have considered contexts and this idea, for 
instance, that there is more to rules, from cognition to organization [3, 5—9] but then 
paying more attention to historical contexts in terms of bureaucratic and regulatory 
trends of the late twentieth and early twenty-first centuries [1, 2, 4, 10, 11]. 

In this respect, the perspectives offered in this book by multiple traditions (soci- 
ology, psychology, management, criminology, cognitive engineering) are a blessing. 
Bringing multiple angles, methods, concepts, and vocabularies, these chapters avoid 
the excessive restrictions of a single view and contribute to sensitizing to contexts. 
Associated with the picture introduced in this chapter, they reveal the importance 
of thinking rules and autonomy, centralization and decentralization, or anticipation 
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and resilience from an organizational or system angle. They can be categorized into 
three types of contributions. 


Finding or losing the balance 

Uncertainty Regulation in High-Risk Organizations: Harnessing the Benefits of 
Flexible Rules by Gudela Grote 

Producing Compliance: The Work of Interpreting, Adapting, and Narrating by 
Ruthanne Huising 

Untangling Safety Management: From Reasonable Regulation to Bullshit Tasks 
by Kristine Storkensen 

The situations, roles, and influence of middle-managers and top management 
Ambiguity, Uncoupling, and Autonomy: The Criminology of Organizational 
Middle-Management by Paul Almond 

The Effect of Top Managers’ Organizational Reliability Orientation by Rangaraj 
Ramanujam 

When autonomy, initiative, and resilience take the lead 

Interlocking Surprises: Their Nature, Implications, and Potential Responses by 
Moshe Farjoun 

Resolving the Command—Adapt Paradox: Guided Adaptability to Cope with 
Complexity by David D. Woods. 


1.6 Finding or Losing the Balance 


The issue of “finding or losing the balance regarding safety rules” is addressed in three 
of the chapters of this book. Gudela Grote advocates, from a psychological angle, 
in Uncertainty Regulation in High-Risk Organizations: Harnessing the Benefits of 
Flexible Rules, a practical way of finding a balance. It consists in articulating in a 
coherent manner dimensions such as uncertainty, autonomy, flexibility, and (safety) 
rules to the diversity of situations met in work contexts. Rules can be of different types, 
action rules (describing precisely what to do), process rules (providing guidance 
about what to do), and goal rules (helping set priorities about what to do), and these 
types should be adapted to the level of uncertainty of situations. An attention to the 
right level of expertise is therefore needed when flexibility is expected. 

In Producing Compliance: The Work of Interpreting, Adapting, and Narrating, 
Ruthanne Huising follows a descriptive, ethnographic perspective, showing how 
compliance with the law and standards by producing and following rules is concretely 
made possible daily in practice, in organizations. It requires the work of dedicated 
people, compliance officers (technicians, officers, and managers) involved, prag- 
matically, in what is defined as an accountability infrastructures made of offices, 
technico-legal experts, programs, operating procedures, technologies, and tools. This 
pragmatic translation, to find a balanced strategy between (safety) rules and work, 
follows a pattern of interpretation, adaptation, and narration involving an array of 
actors, and their relationships, which produce contexts’ relevant outcomes. 
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When such a balance is lost, Kristine Storkensen in Untangling Safety Manage- 
ment: From Reasonable Regulation to Bullshit Tasks argues that the expression of 
bullshit jobs becomes a good characterization of what an excess of rules entails for 
many people affected by this excess. When workers, managers, or engineers start 
doubting about the relevance of their activities and the value of what their paperwork 
generates, it is a likely indication that rules might have become a hindrance without 
much purpose rather than a support to daily operations. Specifying the different levels 
of sociotechnical systems which contribute to a widespread case of bureaucratization 
across domains, Stgrkensen offers possibilities of improvement through strategies of 
relabeling, moving, and ultimately, removing such unwanted and problematic tasks. 


1.7 The Situations, Roles, and Influence 
of Middle-Managers and Top Management 


The topic of “situations, roles, and influence of middle-managers and top manage- 
ment” is covered by two chapters. In Ambiguity, Uncoupling, and Autonomy: The 
Criminology of Organizational Middle-Management, Paul Almond develops the 
insights from criminology on the topic of this book. Describing the role of middle- 
managers in their active contribution regarding compliance with rules, he situates 
them at the heart of complex organizations, in their difficult roles halfway between top 
management and frontline realities. Their responsibility and autonomy in this respect 
take place in the midst of potential ambiguities of meaning (regarding the extent 
of complying—or not—with rules in tough business contexts), structural uncou- 
pling (existing differentiated units within organizations with a certain degree of 
freedom, identities, and cultures), and autonomy deficits (managing difficult situa- 
tions—getting the job done—on behalf of organizations without their support in case 
of compliance breach, retrospectively). 

In The Effect of Top Managers’ Organizational Reliability Orientation, Rangaraj 
Ramanujam proposes a management analysis, based on high-reliability research, 
contrasting what he describes as a modular orientation and a systemic orienta- 
tion. A modular orientation represents a view of work and organizations as stable, 
unambiguous, formal, and proactively managed, while a systemic one represents 
an understanding made of instability, ambiguity, informal reality, and improvisa- 
tion. With this conceptualization, he addresses the likely role and influence of top 
management team on practices in organizations when it comes to rules, reliability, 
safety, and events. Because top management teams affect organizational design, 
performance measurements, incentives, and accident investigations, such orienta- 
tions, capturing two opposite mindsets, might indeed play a role in how they shape 
practices. Ramanujam argues that the need for a systemic orientation is ripe, consid- 
ering multiple contemporary trends (including a post-Covid world) exposed in his 
chapter. 


10 J.-C. Le Coze 


18 When Autonomy, Initiative, and Resilience Take 
the Lead 


The idea that such current trends should be included in a discussion about (safety) 
rules prompts some researchers to emphasize the importance of resilience over antic- 
ipation. This situation “when autonomy, initiative, and resilience take the lead” is 
explored in two chapters. With Interlocking Surprises: Their Nature, Implications, 
and Potential Responses, Moshe Farjoun develops an argument about the likelihood 
of events which seriously defy our past habits of coping with the unexpected and 
require new practices of resilience. The reason for this evolving situation is the 
possibilities of interlocking surprises across space, time, and scale which, in his own 
words, are “evolving, recursive, multiplex, cumulative, and nested”. An increase of 
interconnectedness is certainly one source of such novelties, and the COVID-19 has 
played role in increasing this awareness. Farjoun advises organizations to follow 
diverse strategies when the time comes, from requisite variety to breaking affinities, 
through robust response. 

To Dave Woods, the relation between anticipation—resilience is a paradox. The 
paradox is that there is a definite need for plans to specify action but people must adapt 
such plans at the sharp end because of the uncertainties, constraints, complexities of 
real-life situations. So here is the paradox of safety management. In Resolving the 
Command-Adapt Paradox: Guided Adaptability to Cope with Complexity, Woods 
argues that the two work together through the principle of guided adaptability. In this 
chapter, he relies on several decades of studies to delineate a theoretical yet practical 
answer to this paradox. Situating his reflection in complexity science, at the interfaces 
of natural, artificial, cognitive, and social sciences, the notions of brittleness, collapse, 
boundaries, and envelopes frame this issue as an adaptive one for which the principle 
of “plan and revise’ constitutes the engine. 
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Chapter 2 A) 
Uncertainty Regulation in High-Risk get 
Organizations: Harnessing the Benefits 

of Flexible Rules 


Gudela Grote 


Abstract There is increasing awareness that uncertainty cannot be “managed away” 
to ensure safety. However, how uncertainties can be handled more effectively is still 
a debated question. In this chapter, I offer a new approach to uncertainty regulation 
in organizations, which includes opening and closing behaviors aimed at reducing 
and increasing uncertainty respectively in an attempt to align stability and flexi- 
bility requirements for effective and safe performance. I then apply this approach to 
decisions on rules and operating standards as one of the most fundamental tasks of 
risk and safety management. By proposing the use of flexible rules and participa- 
tory processes for writing, implementing, and monitoring rules, I aim to answer two 
fundamental questions that have plagued effective rule management: How can rules 
successfully guide behavior even if substantial amounts of uncertainty about the right 
course of action in any given situation remain? How can rules instigate autonomous 
motivation for rule compliance? I close by suggesting steps that organizations can 
take to explore and implement the proposed new approach to uncertainty. 


Keywords Uncertainty regulation - Opening behaviors - Closing behaviors - 
Flexible rules - Safety + Autonomy 


2.1 Introduction 


Organizations that have to responsibly handle high operational risks have long aimed 
to do so by quantitatively estimating both the risks they are faced with and the effects 
of measures to mitigate these risks. While this remains the dominant approach in 
risk and safety management, there is growing concern that there are a number of 
challenges that cannot be adequately met by this approach [2]. Uncertainties need to 
be acknowledged that by their very nature cannot be quantified and a mere focus on 
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reducing risks and uncertainties in risk mitigation neglects the necessity to improvise, 
learn, and innovate in view of these uncertainties. 

In this chapter, I address these challenges by proposing a new approach to uncer- 
tainty regulation in organizations. I then apply this approach to decisions on rules 
and operating standards as one of the most fundamental tasks of risk and safety 
management. Lastly, I discuss possible steps toward adopting this new approach to 
uncertainty. 


2.2 Definitions of Uncertainty 


Uncertainty is ubiquitous. Accordingly, debates on how to define and manage uncer- 
tainty abound. For the purpose of this chapter and the proposed new approach to 
uncertainty, I refer to two distinctions to position uncertainty: 


e Aleatory uncertainty is related to the randomness of events and cannot be directly 
influenced, but captured in probabilities at best. Epistemic uncertainty refers 
to lack of knowledge and can be influenced by seeking knowledge in a given 
situation or entering new situations with new unknowns. Uncertainty regulation 
only includes epistemic uncertainty, that is in the most basic terms uncertainty 
stemming from “not knowing for sure” [9, 17]. 

e Exogenous uncertainty is the uncertainty present in an actor’s environment. 
Endogenous uncertainty is uncertainty as perceived by the actor, which is affected 
by exogenous uncertainty, but also by the actor’s capabilities, attitudes, and 
motives related to recognizing and appraising uncertainty. Actors can only influ- 
ence endogenous uncertainty, which may indirectly impact exogenous uncertainty 


[7]. 


2.3 Uncertainty Regulation in Organizations 


The proposed approach builds on uncertainty regulation theory as suggested by 
Griffin and Grote [7]. Regulation in this theory refers to processes internal to an actor, 
which help the actor to manage internal and external demands during goal striving. 
The theory was developed from the perspective of individuals who accomplish tasks 
in a work setting. It posits that work performance relies on two intertwined self- 
regulatory processes: (1) Endogenous uncertainty related to the task to be performed 
is addressed by behaviors that enable different amounts of flexibility in response to 
that uncertainty, called opening and closing behaviors, opening behaviors such as 
suggesting changes to existing procedures or raising concerns about a current course 
of action momentarily even increase uncertainty, whereas closing behaviors such as 
seeking confirmatory feedback or following a routine process reduce uncertainty. 
(2) Independent of what the specific task requirements are, endogenous uncertainty 
is increased or decreased in line with an individual’s uncertainty preferences, e.g., 
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a curious person may use many opening behaviors that increase uncertainty, such 
as trying out new tasks or changing jobs. If individual uncertainty preferences and 
the uncertainty to be handled in a task align, then the two processes interact in an 
effective way leading to successful performance. However, the interaction between 
the two processes can also entail that an individual who is averse to uncertainty, 
responds with routine behavior to a task that would require innovation, leading to 
suboptimal performance. The reverse is also conceivable: an individual who loves 
to learn and innovate tries out new behaviors in a task that would require sticking to 
existing rules and routines, again resulting in suboptimal performance. 

This theory can be transferred to the functioning of organizations in two ways. 
First, one may assume that the same kinds of individual processes apply to key 
decision-makers in organizations, such as members of the top management team, 
which brings the suggested processes to the organizational level because these indi- 
viduals’ behavior impacts the whole organization. For instance, anew CEO may even 
have been hired because of their known willingness to increase uncertainty for them- 
selves and the organization, leading to many opening behaviors that—depending 
on what the actual organizational challenges are—may affect organizational perfor- 
mance positively or negatively. Second, one can turn to processes of organizational 
governance and seek to identify preferences for opening and closing behavior at the 
institutional level and their effects on organizational performance. A young company 
may mostly rely on opening behaviors, such as trying out new products and markets 
in search for the best opportunities to grow, whereas more established firms often 
have built a stock of organizational routines for core processes and mostly rely 
on those. The effects on performance again depend on the particular circumstances, 
where possibly young organizations embrace uncertainty to a point where they cannot 
handle the ensuing operational risks anymore, or established organizations realize 
too late that their routines do not match emerging environmental changes. Lastly, 
one has to consider that individual and institutional processes depend on each other. 
It is through the action of key decision-makers that new institutional processes are 
introduced and old ones abandoned. 


2.4 Flexible Rules 


2.4.1 Basic Problems with Rules: Uncertainty and Autonomy 


Rules, defined as any prescriptions that guide behavior and coordination among 
actors in a social system, are a cornerstone of risk and safety management [13]. 
Rules are to reduce variation in behavior and with that ensure the correct—that 
is also, safe—way of acting in any given situation. Rules thus are considered the 
silver bullet for ensuring safety by many. However, anyone involved in writing and 
implementing rules has a different story to tell. It is impossible to come up with rules 
that control all conceivable behavior in all conceivable situations, not to speak of the 
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non-conceivable behaviors and situations [5]. Even if rules can capture the necessary 
behavior, rule compliance is notoriously difficult to monitor and enforce. 

Two issues lie at the heart of these difficulties: uncertainty and autonomy. Rules 
are derived from knowledge about the correct course of action in a given situation. 
They therefore require that uncertainty about what the correct course of action is has 
been sufficiently reduced to be confident in the chosen action being the right one. 
Obviously, this cannot always be achieved, and the resulting rules may lead actors 
to do the wrong thing, unless they decide to violate the rule as they realize that it 
does not fit the circumstances they find themselves in. Many accidents have been 
caused because people followed the prescribed, but inadequate course of action, 
just as other accidents resulted from people not following rules, potentially with 
all good intentions because they felt that the prescribed behaviors did not match 
the situational demands. The opposite is obviously also true: People follow rules in 
useful ways and also sometimes deviate from rules in useful ways. However, because 
recovery from difficult situations is usually not systematically tracked, organizations 
often lack knowledge on successful rule violations. Therefore, there is generally too 
little awareness of the uncertainty actors are faced with when trying to follow rules 
[18]. 

The second issue, autonomy, has two important facets. One facet is directly linked 
to the previous discussion about uncertainty. To successfully face uncertainty, actors 
need to have freedom of action, i.e., autonomy, to adapt their behavior as new knowl- 
edge emerges and to proactively choose new courses of action to explore and impro- 
vise in the face of highly unexpected circumstances. If actors violate rules because 
the rules turn out to not be helpful, they exercise this autonomy. The second facet of 
autonomy is the expression of agency through autonomous action which is a major 
motivating force for human behavior. Individuals are motivated to engage in activi- 
ties of their own accord (= autonomous or intrinsic motivation) when these activities 
are inherently interesting and/or meaningful [6]. People in general resent attempts 
to curtail their autonomy and are found to be less motivated and satisfied at work or 
in other settings when they feel externally controlled. Rules are a very direct form 
of external control, therefore, it is hard to create autonomous motivation for rule 
compliance. Punishment for non-compliance has been found to be an insufficient 
or even counterproductive driver of behavior, frequently leading people—and even 
whole organizations—to cover up inadequate behavior. Rewards for compliance may 
work better, but in this case the motivation for the correct behavior nevertheless stems 
from external factors rather than from an internal desire. 

Following from these considerations, there are two questions to be answered: 
How can rules successfully guide behavior even if substantial amounts of uncertainty 
about the right course of action in any given situation remain? How can rules instigate 
autonomous motivation for rule compliance? 
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2.4.2 Rules as Part of Uncertainty Regulation 


With respect to the first question, understanding how rules operate through the lens of 
uncertainty regulation helps to redefine and broaden the function of rules in guiding 
behavior even in situations with substantial uncertainty. For this to happen, orga- 
nizations should adopt a process for systematically managing the introduction and 
adaptation of rules along the following five steps [12]: 


i. 


ii. 


iii. 


iv. 


Any situation for which a rule is to be devised should be analyzed in terms of 
the uncertainty the situation entails. 

Depending on the amount of uncertainty, different rule types should be employed 
that include different degrees of flexibility in line with the uncertainty that needs 
to be handled by the actors [14]. Such “flexible rules” may also momentarily 
increase uncertainty, for instance when they require the actor to consider more 
choices for possible behaviors in a given situation. 


e If there is little or no uncertainty as to what the correct course of action in 
a situation is, then action rules should be used, that is rules that specify in 
much detail what that correct course of action is. 

e If the uncertainty is fairly limited, then the right choice are action rules 
with systematic inclusion of degrees of freedoms to allow for adaptations in 
behavior in view of that uncertainty, by using terms such as “if needed”, 
“in light of specific conditions”, or “depending on the availability of further 
information”. 

e If there is uncertainty about which of a number of possible behaviors is the 
correct one in a given situation, and that decision has to be made by the actor 
based on emerging information in the situation, process rules should be used, 
that is rules that guide the actor in collecting information, coordinating with 
others, etc. in the process of deciding on the right course of action. 

e Ifthere is much uncertainty and there are no means to reduce that uncertainty 
for the actor beforehand, the only way to guide action is to provide goal rules, 
that is rules that help to set priorities and keep the overall direction of action 
within certain bounds. 


The use of different rule types should also be considered in light of the assumed 
uncertainty preferences of the actors for whom the rule is devised. Obviously, 
differences between single individuals cannot be accounted for when rules are 
written, but differences between professional groups, hierarchical levels, or other 
broader categories should be examined. For instance, differences in knowledge, 
ability, and prior experience as well as in professional codes of conduct or 
cultural norms are likely to shape the willingness to cope with existing uncer- 
tainty and the desire to further reduce uncertainty or on the contrary increase 
uncertainty as a means for learning and competence development. 

The experience with existing rules needs to be monitored, and feedback by all 
actors encouraged as part of a continuous learning process for which knowledge 
of “successful” rule violations is particularly important. In this process, it is 
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also important to consider whether there are outdated rules, which need to be 
abolished, and whether all actors are always fully up to date on the currently 
valid rules. 

v. The processes involved in rule making should be embedded in an overarching 
concept of how an organization approaches uncertainty. Following the Griffin 
and Grote [7] theory and earlier work by Grote [10], organizations should 
consider costs and benefits of reducing and increasing uncertainty in light of 
performance requirements in different situations. We return to this point in the 
final section when we discuss which steps organizations might take to adopt a 
new approach to uncertainty. 


2.4.3 Rules as Constraints and Enablers for Behavior 


To answer the second question of how autonomy can be preserved when for safety 
reasons there must be strict bounds on permissible behavior, a closer look at who 
decides on rules is helpful. Mostly, rules are made for others as a means of control- 
ling their behavior, which then creates the motivational problems already discussed. 
If, however, people make rules for themselves, they are given a different kind of 
autonomy, that is the autonomy to make decisions on restricting one’s own autonomy. 
Such “higher-order autonomy” [8] can keep autonomous motivation alive as restric- 
tions of one’s freedom to act are taken voluntarily and with full understanding for why 
they are necessary. Participation in rule making, assessment of existing rules, and 
continuous feedback on and adaptation of rules thus is key to promoting autonomous 
motivation for rule compliance [3, 16]. 

Moreover, if the restrictions are chosen in line with the uncertainty considerations 
discussed in the previous section, then it becomes clear that rules do not only constrain 
but may also enable behavior [1]. When actors have to handle difficult situations with 
high amounts of uncertainty, goal and process rules provide some guidance, but also 
leave sufficient flexibility to adapt behaviors as needed. Thus, actors receive help in 
managing the uncertainty, but are also empowered to make their own decisions. This 
autonomy needs to be coupled with adequate education and training to ensure that 
actors have the required knowledge and skills to make adequate use of the offered 
degrees of freedom. Additionally, actors’ uncertainty preferences have to be taken 
into account. Flexible rules demand a willingness by actors to accept or even increase 
uncertainty, which can be fostered by competence building and by creating a culture 
in the organization that encourages empowerment and learning [12]. 
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2.5 Steps Toward Adopting a New Approach to Uncertainty 


For organizations to adopt flexible rules as a way to more effectively regulate uncer- 
tainty, predominant perspectives on risk and safety management need to be reflected 
upon. At their core, these perspectives concern deep-rooted assumptions about the 
relationship between safety and autonomy [11] and the necessity to create stability 
by reducing uncertainty [10]. Despite the increasing emphasis on organizational 
resilience as the answer to managing the unexpected [15, 21], many organizations 
still aim to minimize uncertainty in the hope to maintain stability and control as 
prerequisites for safety. Autonomy that would allow flexible action and resilient 
adaptations to external changes is considered unnecessary or even dangerous as it 
threatens routine operations. Accordingly, a first step is for organizations to reeval- 
uate the balance between stability and flexibility that is required for different opera- 
tions. Flexibility demands mostly stem from having to cope with uncertainty, while 
stability demands result from internal and external requirements for predictability 
and control. These demands may vary between different parts of the organization 
and also between different points in time and have to be monitored and reassessed 
frequently [4]. 

Once it is clear that uncertainty regulation is about more than just trying to mini- 
mize uncertainty, the relationship between safety and autonomy needs to be scruti- 
nized as a second step. If safety requires the full range of opening and closing behav- 
iors because situations frequently change and behavioral routines have to be comple- 
mented by learning and exploration, actors have to be empowered to autonomously 
choose the right behaviors. The different kinds of flexible rules discussed earlier can 
help them to make good choices. 

As a third step, organizations should reflect on basic assumptions and values 
shared by their members which promote or hamper a fuller understanding of this 
new approach to uncertainty regulation [19, 20]. Thereby, organizational culture 
is highlighted as a driving force behind organizations’ practices in risk and safety 
management. Only if there is a shared commitment to broadening the perspective 
on uncertainty and empowering actors to respond to and possibly even increase 
uncertainty, can measures such as flexible rules be successfully implemented. 
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Chapter 3 A) 
Producing Compliance: The Work giecik; 
of Interpreting, Adapting, and Narrating 


Ruthanne Huising 


Abstract Organizations, to comply with regulations and growing prosocial 
demands, develop robust accountability infrastructures: offices, techno-legal experts, 
programs, operating procedures, technologies, and tools dedicated to keeping the 
organization’s operations in line with regulations and external standards. Although 
an organization has a single, unified accountability infrastructure—one program, 
one set of policies and procedures, and so on for environmental management, or 
health and safety, or risk management—this infrastructure must produce compliance 
across a dynamic, complex organization. This happens when and because compliance 
managers and officers make a single, unified accountability infrastructure multiple 
and diverse in its day-to-day implementation. This approach to compliance work 
is pragmatic in the sense that rules and requirements are altered based on a deep 
understanding of regulatory expectations, local operations, and local work cultures. 
It depends on the skilled interpretation and adaptation of regulation and narration of 
compliance. 


Keywords Compliance - Pragmatism + Expertise - Work - Regulation 


3.1 Introduction 


Traditional regulatory approaches tend to produce one-size-fits-all regulatory frame- 
works that gloss over important differences among organizations and rely on 
command-and-control style enforcement. Contemporary regulatory approaches — 
performance-based regulation, responsive regulation, risk-based regulation, light- 
touch regulation, and so on—rely on regulated organizations to design and manage 
homegrown systems. Beyond achieving compliance with regulatory expectations, 
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organizations must provide an account of how they organize to produce compli- 
ance. Regulated parties are encouraged to tailor their compliance programs, contin- 
uously observing, aligning, and improving compliance efforts rather than adhering 
to off-the-shelf prescriptions. Such contemporary approaches require that organiza- 
tions internalize the regulatory work of setting standards and guidelines, developing 
policies and procedures, auditing, and correcting. 

This shift in regulatory approach, combined with the growth of prosocial demands 
on organizations, requires that organizations develop robust accountability infras- 
tructures: offices, techno-legal experts, programs, operating procedures, technolo- 
gies, and tools dedicated to keeping the organization’s operations in line with regu- 
lations and external standards [1]. This includes systems for managing health and 
safety, environmental sustainability, enterprise risk, diversity and inclusion, quality, 
GDPR, corporate social responsibility, and so on. As the complexity and sophistica- 
tion of accountability infrastructures grow—aided by consulting firms, professional 
and industrial associations, and information technologies—organizations should not 
lose sight of the fact that training programs, manuals, inspection checklists, stan- 
dard operating procedures, and databases do not by themselves create compliance. 
Accountability infrastructures rely on human expertise and discretion to understand 
local conditions and constraints across the organization, and to situate and adapt 
instructions to suit these conditions in ways that preserve compliance goals. 

The central issue then is that although an organization has a single, unified account- 
ability infrastructure—one program, one set of policies and procedures, and so on for 
environmental management, or health and safety, or risk management—this infras- 
tructure must produce compliance across a dynamic, complex organization. This 
happens when and because compliance managers and officers make a single, unified 
accountability infrastructure multiple and diverse in its day-to-day implementation. 
This approach to compliance work is pragmatic in the sense that rules and require- 
ments are altered to be useful in relation to the context in which they are applied. 
Pragmatic compliance depends on staff recognizing the need for local adaptation of 
rules and appropriately varying rules based on a deep understanding of regulatory 
expectations, local operations, and local work cultures. Together this techno-legal 
expertise depends on skills in interpreting, adapting, and narrating compliance. 


3.2 Studying the Work of Compliance Officers 


The daily, face-to-face work of ensuring that organizational operations align with 
regulatory demands and other prosocial concerns is the responsibility of compli- 
ance officers. Over the past 20 years, I have observed technicians, officers, and 
managers responsible for compliance—health and safety, radiological safety, and 
biological safety—as they work [2-6]. Following them on inspections, attending 
their trainings, and watching them solve problems, write procedures, and manage 
tight budgets, I have seen them in action in their organizations. I have also trailed them 
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at national conferences, regulatory training sessions, professional association meet- 
ings, and showdowns with regulators. Through extensive longitudinal and compara- 
tive observation, interviews, and archival work, I have observed different approaches 
to compliance work. 

Compliance officers who work pragmatically understand their work as managing 
the gap between the compliance expectations and the daily enactment of these expec- 
tations [6]. Their work is to narrow this gap as much as possible by understanding 
how the daily performance of compliance expectations may be experienced as diffi- 
cult or incompatible with operational goals and procedures. From this perspective, 
producing compliance requires understanding the social, political, and operational 
barriers to following rules and procedures rather than psychological ones. To take 
such an approach requires that compliance staff develop an extensive and deep under- 
standing of the operations and work of the organization. Further, it requires that they 
develop an appreciation for the variation of conditions that exist across the orga- 
nizations including differences in organizational subcultures, management styles, 
budgetary pressures, turnover rates, forms of expertise, etc. To acquire this appre- 
ciation, compliance staff must spend a considerable amount of time in and around 
the organization and outside of their offices, away from their desks, developing local 
knowledge and relationships. Not all compliance offices take a pragmatic approach 
to compliance. Those who lead and direct the compliance staff display different 
approaches to conceptualizing or defining compliance and managing it [2, 3]. 


3.3 Producing Compliance Pragmatically 


Compliance is produced pragmatically when compliance staff understand, appre- 
ciate, and attend to variation in the organization. This knowledge is used to interpret 
and adapt regulation, and narrate compliance. The claim is that when local context 
is taken into account in developing and enforcing compliance efforts, compliance is 
more likely to be consistently observed. By articulating and fitting regulation in rela- 
tion to the situation in which it must be enacted, regulation will be better customized 
and focused to that situation. This approach should not be understood as a cover 
for incoherence or a slide into permissiveness. Instead, attention to the local and 
the particular allows organizations to meet the universal ends that regulation seeks. 
Rules that recognize and reflect the diversity of situations make the enactment of 
regulation versatile and multiple in a way that is not only compatible with but in 
service of its universal goals. A pragmatic approach weaves regulation in a sensible, 
responsible way through the human foibles, cycles of work, constraints on change, 
limited money, and deadlines that make up organizational life. 
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3.3.1 Interpreting Regulation 


Moving across multiple regulators and sets of regulations, compliance officers must 
“work out” which regulations are in play for particular activities in their organiza- 
tions, what those regulations “say”, and how to manifest them appropriately across 
the organization. The need for interpretation stems from the multiple, misaligned, 
complex, general and incomplete quality of regulations. Regulations, because they 
must cover a wide range of contexts and situations, are often general and incomplete 
relative to a particular context. Compliance officers must fill in such voids. Regula- 
tions may also be, at first glance, appear infeasible relative to the scale or breadth 
of an activity within an organization. Compliance officers seek clarification from 
regulators about these requirements and how they can be made feasible within the 
context. Regulations are also often silent, unable to anticipate every situation and 
emerging situations. In this case, compliance officers must work with regulators to 
understand how to appropriately hand such situations. 

The need for interpretation also stems from the particularities of the organiza- 
tion’s activities and how they are staffed, mechanized, and organized. Equipment 
and architecture may deviate from ideal. Combinations of hazards may not be 
directly or easily addressed in regulations. Compliance officers try to understand 
what regulators expect from the organization but also how the organization can 
be made—through local fixes and workarounds—compliant. This “working out” 
is done with the possibility that the interpretations produced may or may not be 
shared by regulators or be acceptable or affordable from a managerial perspective. 
The interpretative work of compliance officers ultimately defines compliance within 
and across the organization, producing local prescriptions that are externally and 
internally legitimate. 


3.3.2 Adapting Regulation 


Adapting compliance practices across the organization depends on recognizing varia- 
tion across operating situations and contexts. This variation may stem from physical, 
technological, or cultural differences in the organization. Units or divisions may 
emerge from different histories, be built on different professional cultures, or have 
significantly different status and resources in the organization. Compliance prac- 
tices, if they are to be useful, need to be adapted in accordance with these varying 
contexts. Compliance oversight including inspection, training, and informal dialogue 
should also vary across contexts. Some pockets of the organization require more 
frequent inspection, not because of the inherent risk of activities, but because of 
the local culture, turnover, novelty of the operations, and so on. Adaption should 
also consider the temporal rhythms of different operational aspects, assessing and 
assisting compliance efforts according to the operational life cycle. 
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Variation within organizations is at times understood as deviance from and failure 
to conform with centralized standards and norms. Such an understanding ignores the 
real differences in constraints and resources across local units within an organization 
and may prompt efforts to punish and homogenize locally productive variation. Prag- 
matic compliance requires that compliance officers have detailed knowledge of the 
landscape of the organization, understanding variation in conditions and resources 
so they can calibrate their interactions and tactics to particular situations. Accommo- 
dating variation may involve giving different units or groups some freedom to develop 
their own responses and practices in response to regulations. It may also involve 
experimentation—iteration and learning—with different approaches to compliance 
across the organization. 


3.3.3 Narrating Regulation 


Compliance staff working to bring accountability infrastructures alive across the 
organization must go beyond measuring compliance to providing accounts of how 
they organize to produce compliance. They do this through talk, text, numbers, and 
figures. They are required to narrate compliance processes to several audiences, 
and these narratives perform different functions. External parties, including regula- 
tors require that compliance offices, periodically and formally account for how they 
more or less align organization operations with regulatory expectations and how they 
achieve this. These are well-known moments of narration. As are narrative accounts, 
again often formal, that are sent up the hierarchy to inform senior management and 
the board of compliance activities. These formal moments of narration are crucial 
for securing approvals, resources, and legitimacy. 

Narration of compliance and non-compliance also occurs on an ongoing basis, 
through less formal means, among compliance officers, managers, and employees. 
These accounts provide a means of through compliance staff teach, learn, and legiti- 
mate the human judgment and professional discretion needed to implement account- 
ability infrastructures. They are also acrucial means of developing interpretations and 
adaptations of regulations. For example, in one organization, concerns about drain 
disposal of materials across over 500 laboratories and in accordance with myriad 
regulations emerged and were addressed through months of inquiry accompanied 
by ongoing narration. Histories of the buildings’ infrastructures that had been built 
and renovated over many decades were required [6]. These inquiries revealed that 
multiple narratives circulated for the same building, leading to misunderstandings 
about compliant practices. 

Articulating variation in compliance practices and their effects verbally or textu- 
ally provide a circulating means for compliance officers and managers to understand 
how interpretation and adaptation work to create compliant operations. Narrating 
compliance practices also facilitates learning and further adaptation by sharing near 
misses, incidents, accidents, and failed attempts to vary the regulation. 
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3.4 The Challenges of and to Pragmatic Compliance 


The work of pragmatic compliance depends on several conditions. First, it depends 
on hiring compliance workers who understand their work through a holistic and prag- 
matic lens or training them to understand this. Rather than understanding their work 
to be strictly delimited to creating and managing accountability infrastructures, they 
must recognize that their work is to bring these infrastructures alive in different ways 
across the organization [7]. Second, it requires more than techno-legal expertise. It 
requires an interest in and knowledge of the operations and cultures that make up 
the organization. Compliance staff, to appropriately adapt regulations to be func- 
tional and meaningful across the organization require significant knowledge of the 
organization’s operations and its variation. To generate and cultivate such knowledge 
compliance staff need to spend significant time interacting with and learning from 
the managers and workers whose actions and routines they are trying to shape. In 
addition to knowledge, they are developing relationships and channels of communi- 
cation that keep their knowledge base current. Third pragmatic compliance depends 
on empowering compliance staff with time and authority to interpret, adapt, and 
narrate. Importantly, these workers require the authority to adapt rules and to narrate 
these alternatives. 

Beyond the work of compliance staff, pragmatic compliance depends on orga- 
nizations and regulators accepting multiple narratives of the methods and means of 
producing compliance. Rather than requiring a single, unified account of compliance, 
multiple and varying accounts must be accepted and understood as a signal of learning 
and adaptation rather than deviance. This may be the most significant challenge for 
pragmatic compliance. Regulators often expect and organizations design singular 
systems that provide a strong, unified narrative of compliance. These systems are 
supported by data collection, inspection, and reporting systems that are standardized 
and thus singular. How to make the expectations and supporting systems “pragmatic 
friendly” is an open question. Again, it seems to rely on the fundamental observation 
that human interpretation, adaptation, and creativity are necessary to bring legal and 
technical systems alive. 


3.5 Conclusion 


Ultimately managing the gap between the compliance expectations and the daily 
enactment of these expectations depends on changing and sustaining change in the 
daily routines of the organization. Creating and sustaining organizational change 
is a significant challenge. Thus, beyond operating pragmatically, compliance staff 
must consider how a reinforcing system of bureaucratic, cultural, and behavioral 
support can produce compliance [8]. Again, rather than a singular approach to compli- 
ance, multiplicity is required to generate change. This need for multiplicity along 
with appreciation of variation—healthy and necessary variation—in organizations 
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emphasizes the need for compliance staff who are enabled and able to exercise 
discretion—interpretation, adaption, and narration—to bring regulation alive in the 
organization. 
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Chapter 4 A) 
Untangling Safety Management: From crest 
Reasonable Regulation to Bullshit Tasks 


Kristine Vedal Stérkersen and Håkon Fyhn 


Abstract In this chapter, we argue that the management of values like safety and 
quality often leads to the creation of unnecessary tasks that interfere with the actual 
work being done. These tasks, referred to as “bullshit tasks”, are experienced as mean- 
ingless and time-consuming. We draw on two decades of empirical research in safety 
management and work practices in various industries and organizations. We highlight 
examples where regulations and management systems result in paperwork overload 
and hinder the efficiency of workers. We discuss how the sociotechnical system, 
including government regulations, management practices, and worker perspectives, 
contributes to the proliferation of bullshit tasks. We emphasize the need for a funda- 
mental change in how regulations are made, enforced, and audited to address this 
issue, and suggest that organizations and managers can take steps to reduce bullshit 
tasks and improve the overall efficiency of work processes. 


Keywords Safety management - Organization * Sociotechnical system + Bullshit 
tasks + Automation 


Safety. Quality. Transparency. Accountability. Nice words, great values. However, 
the management of these values is not always well-received by workers, as safety 
and quality do not have the same connotations as safety management and quality 
management. Our research from several projects shows that addressing such values 
tends to generate requirements that interfere with the core work, or “real work”, as 
it is often called. In other words, safety management interferes with safe work. It 
is not surprising that such values are difficult to manage, but it is surprising that 
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we have failed for so long and continue to use the same methods. In this chapter, 
we start untangling the messy state of safety management by exploring how safety 
management is influenced by the surrounding sociotechnical system. We describe 
how the organizational and technological systems encourage a tendency to move 
safety management away from the sphere of human experience—the sphere in which 
“real work” is performed and understood—toward more non-sense or bullshit tasks. 
At the end of this chapter, some actions to mitigate bullshit are suggested. 


4.1 Background and Examples 


The empirical approach of this chapter is not based on a straightforward research 
design, but rather the authors’ various empirical experiences. For two decades, we 
have studied safety management, organizations, and work. We have conducted inter- 
views, surveys, and fieldwork in different public and regulatory entities, as well as 
industries and private companies within construction, aquaculture, fisheries, and 
education. Over the years, we have interviewed more than one hundred people 
in different positions in a range of organizations. While the specific topics of the 
interviews have differed, a clear majority of the interviewees have been frustrated 
about extensive management systems, bureaucratized computer systems, or reporting 
procedures eating away at the time that should have been spent on their “real job” 
[11, 13, 36, 38]. They described their tasks in an opposite hierarchy as illustrated 
in Fig. 4.1, where their primary work was hampered by other tasks. Personnel at 
all levels had tasks they could not see the purpose of doing, with output seemingly 
disappearing into a “black hole”. Such tasks were typically extensive documentation 
of simple routine chores, reporting in systems they never saw anyone use, following 
procedures that gave little sense, or ordering things through computer programs that 
took more time than going to the physical store. While we also identified many posi- 
tive outcomes of safety and quality management, and situations where the systems 
worked according to its intentions, the many negative implications were irrefutable. 
Operational personnel, managers, and regulators all talked about “all this bullshit or 
non-sense that we don’t know how to get rid of”. 

For example, in a study of energy consultants, the introduction of new digital 
documentation procedures intended to ensure the compliance of regulations and 
standards, resulted instead in the consultants having to spend their limited consul- 
tation time filling in the digital forms. Due to the time-consuming new procedures, 
they ended up not having sufficient time with the customers, resulting in unsat- 
isfactory solutions. In some cases, the consultant ended up bypassing the whole 
system, making an informal deal with the customer [13, 14]. Another example from 
the construction industry was the introduction of “paper-free building sites”, where 
builders were supposed to build directly from the digital models, rather than printing 
out paper drawings. The goal was to avoid expensive errors occurring when builders 
used different versions of the plans, printed at different points in time. However, at 
all the “paper-free” building sites we visited, builders used paper drawings, either 
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Fig. 4.1 Empirical 
descriptions of different 
types of work tasks 


"The real work" 


Primary /core tasks 
to get the job done 


Secondary tasks: 
- Useful management 
tasks 


-Bullshit tasks 


Daily operations 


openly or in hiding. The most prominent reason expressed by the builders was that as 
the model was never perfect, they had to make changes while building. Furthermore, 
as the digital interface was not designed to incorporate builders’ feedback, using 
pencil on paper allowed them to talk back to the drawing without interrupting their 
workflow [11]. 

When Graeber [15] introduced the term “bullshit job”, meaning a job not even the 
person holding it sees the value in, this resonated with the frustration our informants 
had expressed. However, our studies did not show any jobs that were useless. But 
almost everyone had certain tasks in their jobs they experienced as useless. Tasks 
they wondered if anyone could benefit from, including their employers who were 
demanding they do said tasks. Thus, we became interested in non-sense or bullshit 
tasks. We explored such tasks and their safety relevance in several Norwegian opinion 
pieces and oral presentations (e.g., Stérkersen and Fyhn [37]). To our surprise, these 
pieces were republished in tens after tens of branch-journals for various professions, 
ranging from nursing to diary workers, indicating a widespread frustration with bull- 
shit tasks. Now the time has come to analyze this phenomenon more systematically 
based on the levels of the sociotechnical system. 
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4.2 The Sociotechnical System Entangling Safety 
Management 


To realize how safety management failed, or is linked to bullshit, one must understand 
the broad range of expectations, regulations, and actors the organizations try to handle 
simultaneously [35, 38]. These are a part of the sociotechnical system involved in 
risk management described by Rasmussen [32], emphasizing the connection between 
the societal levels from government to work, and the influence from environmental 
stressors such as the public, market, and technological change. In this chapter, we 
thus build on Rasmussen’s framework to shed light on the road from reasonable 
regulation to bullshit tasks. This is illustrated in Fig. 4.2 and was also visible in the 
example from the energy consultants and the construction sites above: Regulations 
make companies implement measures that may give unintended, troublesome, and 
even meaningless tasks to the personnel [11, 13, 14]. 


4.2.1 Government, Regulations, and Associations 


Regulation is a defense against organizational accidents [33, p. 182], as it bridges the 
gap between public interests and the market. The purpose is to protect employees, 
customers, and society, among other stakeholders [18]. 


Auditors 
System auditing of 
paper trails 


Influence from 
customers, 
market, 
insurance, 
financial, liability 
law, quality 
management, etc. 


Fig. 4.2 An illustration of the sociotechnical system involved in safety management, inspired by 
Rasmussen [32, p. 185], but going from reasonable regulation to bullshit tasks 
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Most quality and safety management regulation and certification schemes are 
goal- and function-based, such as the ISO standards for safety, quality, and risk 
management, as well as national and regional HSE regulations and a range of 
industry-specific standards. It is typical for organizations to mimic each other’s ideas 
of management routines, especially when a solution appears to be the natural way of 
solving a problem [6, 10]. 

Function-based regulations mostly call for internal control through management 
systems. The safety management system must fit a company’s specific activities, but 
also be verified and documented by auditors. These two parts of the regulation— 
practical systems and verification—are often in conflict, and regulatory traditions 
lead the verification to trump practical systems [35]. Auditors have been given the 
power to ensure compliance of safety management and quality management. Veri- 
fication has been described as a clever touch for regulators to give the companies 
the responsibility to both self-enforce the regulations, and to internally control and 
externally demonstrate their accountability [16, 27]. The regulations urge organi- 
zations to implement documentable tasks [24], as documentation is an easy basis 
for checking compliance superficially [19]. However, function-based regulation and 
system auditing may lead to a “checkbox mentality’, as it does not uncover whether 
a management system adequately fulfills its intentions [2, 21]. Hence, functional 
regulations and superficial audits can result in bullshit tasks at the expense of core 
tasks and of trust [30]. 


4.2.2 Management and Company 


The managers in the various industries—like ship owners, construction managers, 
HSE advisors, purchasers, and CEOs—want good operations, but also to comply 
with regulations. Grote [16, 17] and others argue that companies should implement 
procedures with a balance of stability and flexibility. However, documentation of 
operations has become the favored approach to demonstrate accountability [20]. 

Managers are expected to show paper trails to safety regulators, quality manage- 
ment auditors, financial supporters, insurance companies, and a line of stakeholders 
[4]. Liability law can therefore result in extensive management systems, because 
management wants to protect itself through detailed descriptions of task operations 
[22]. This may include complex computer systems that cover documentation and 
reporting information at the same time as an employee is completing their purchases. 
For example, a catering order goes to the canteen for making food, to the manage- 
ment for having control over projects, and to the financial department for sending 
the bill. Or, a medical diagnosis is registered in the patient medical journal, and at 
the same time feeds into hospital payment, statistics, management, and planning of 
resources and hospital beds. 

When managers design the safety management system with tasks for the oper- 
ational personnel, they often overestimate what the personnel has time for and the 
variation in situations they need to handle [40, p. 455], thus implementing more 
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routines and procedures than what is possible to accomplish in practice. Also, as 
audits and accidents often show weaknesses in the managerial system, it is common 
to add documentation tasks [1], which can increase the number of steps in a manage- 
ment system or procedure. These managerial measures may create non-sense or 
bullshit tasks, which seem to be reproduced across organizations and industries. 


4.2.3 Work and Staff 


From the operational personnel’s side, common safety management is not only 
producing routines for safety, it also often produces work that may conflict with 
safety due to the introduction of bullshit tasks. In many industries, safety manage- 
ment systems’ extensive documentation requirements may suppress the attention on 
and time available for safe work [3, 5, 7, 8, 16, 19, 30]. As this captain contemplates 
in an interview referred to in Stérkersen [35, p. ii]: 


I sometimes reflect upon that. We’ve got the papers in order, but is it really better? Do we only 
produce paper?... The Maritime Authority’s statistics are as bad as before, we run ashore 
just as much. 


Safety management tasks not directly ensuring safety are also referred to as 
safety clutter [31]. When there are many safety management tasks, they clutter 
or saturate the operations for the personnel, thus decreasing system performance 
[40]. Tasks that are seen as unfitting, seemingly without value, and unnecessarily 
time-consuming, are perceived as bullshit tasks. They contribute to overloading the 
capacity of the personnel, who must carefully consider which tasks to do and which 
procedures to follow. When management systems include many bullshit tasks, oper- 
ational personnel’s adaptation and competent decision-making may be essential in 
order to get the core tasks done [25, 40]. This demands the personnel to remove 
themselves from the tasks that management expects them to perform. In some orga- 
nizations, both managers and operational personnel jointly experience procedures to 
be mainly there for liability reasons, meaning that they in practice can be ignored 
[35]. Many employees are frustrated with computer systems that are difficult to use, 
because they require new information or checking of multiple boxes to do simple 
tasks. These systems tend to be characterized by drop-down menus leading the user 
through the procedures, while also functioning as gates, stopping the process if a 
certain box is not ticked correctly. This becomes a source of frustration in cases 
where the menu fails to offer adequate alternatives to the situation, and in practice 
stops the work until the “problem” is solved [12]. All in all, the safety management 
tasks are often viewed as external to the core work, constituting two parallel trails of 
tasks—the real work and safety management—as illustrated in Fig. 4.1. The first is 
seen as primary tasks and core work, and the latter seen as secondary tasks, including 
clutter and bullshit tasks [11, 36, 38]. 
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4.3 Managing Through Human-Peripheral Systems 


We have seen how seemingly reasonable regulations make companies implement 
measures that may result in unintended and perceived meaningless tasks for the 
operative personnel. In the previous sections, we have argued that the sociotechnical 
system is vital to understanding why safety management can result in bullshit going 
against safety. Organizations need to comply with a line of regulations and expecta- 
tions, all requiring management systems, documentation, and system auditing. This 
gives an entanglement of safety management, internal control, quality management, 
responsible procurements, and accountability in the organizations’ systems. 

While most workers embody their primary tasks, they usually find it more difficult 
to keep track of the required secondary safety management tasks (see Fig. 4.1), and 
thus wish for support systems. However, management systems come with more than 
support. The logic of management systems focuses on the technological aspects, not 
only as rigid procedures and processes that become even more rigid when digital- 
ized, but also as instrumentality increasingly separated from the sphere of human 
experience [23, p. 296]. As such, the parallel trail of safety management is not only 
time-consuming, but also challenges the professional judgment of staff, as it works 
according to different procedures and logic, calling for other skills than those needed 
for the core work. 

While most agree that professional judgment in some cases necessitates safety 
procedures adhering to a different logic than the judgment being supported (such as 
the jet pilot’s pretakeoff checklist), problems can arise when such checklists become 
systems that determine how a professional should perform their job. Not only because 
they create bullshit tasks that steal time from the “real job”, but because they force the 
job to be performed according to procedures adhering to the logic of the management 
system rather than that of the professional human being. The separation between the 
two trails of tasks (see Fig. 4.1) increases if the tasks are produced by a system 
not built according to points of professional judgment in the workflow of the ones 
doing the job, but rather by a system architecture distant from this sphere of human 
experience. However, even if the system is designed from a point of view in the real 
workflow, it tends to lack the flexibility, openness, and ability to prioritize associated 
with professional human judgment. When the operational personnel are so occupied 
with safety management tasks that it is difficult to find time to do the core tasks, they 
find themselves in an ineffective system, where they need to make decisions based 
on their bounded rationality or in a hurry, and not based on the thorough calculations 
of management. “Knowing when to bend the rules is one of the hallmarks of an 
experienced decision maker” [28, p. 76], but improvised decision-making is rarely 
in anyone’s favor if it occurs because of a malfunctioning system. Further, as such 
systems are created to secure a form of control at a distance for management, they 
tend to be designed to operate by control rather than trust. Trust necessarily implies 
risk [34], which is something compliance systems normally are designed to eliminate. 
The danger, then, is that trust may diminish as a resource, as being given trust tends 
to be a premise for acting in a trustworthy manner [39]. Again, we can see a step 
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in the separation of human and management system, as trust moves from human to 
system. 

On the other hand, the concept of bullshit tasks taps into the sphere of human 
experience, expressing frustration emerging from the experience of meaningless 
tasks cutting into one’s real work and time. Even though some of these tasks are 
regarded as external to the real work, they become real as they conquer the time and 
attention of the staff. Further, as it tends to be the trails of these tasks that are visible 
further up in the organization, they tend to gain ontological weight and thus cause a 
transition in what is regarded as “real”, from the actual work to the representations 
of it, where the representations end up being perceived as more real than the real 
work itself [26]. However, seen from the perspective of the frustration giving rise to 
the term bullshit task, the production of the management systems we have discussed 
here can be seen as steps along a process where we, as Tim Ingold puts it, become 
“the authors of our own dehumanization” [23, p. 311]. 


4.4 Stepping Out of Inertia 


As we have seen, bullshit tasks are defined by their unproductive appearance, their 
unwanted and non-meaningful nature, and their nonetheless common presence. 
Although organizations have made an effort to get rid of them, they are persistent 
because of traditions in how to comply with regulation, such as audits, documen- 
tation, or technology to provide for audits and documentation [9, 14, 31, 38]. This 
may be the case for management of many values and is particularly apparent in 
the safety management area. What is evident in organizations is poorly working 
systems, computer programs, and reporting taking up valuable time. And what is 
evident across organizations is that a fundamental change needs to come at the 
policy-making level—in how regulations are made, enforced, and audited. However, 
it should also be possible to decrease the time spent on bullshit in each organization 
as it is. 

Although organizations obliviously point at regulation and auditors, managers 
surely must possess some leverage and tools to decrease the number of bullshit tasks. 
By paying attention to this phenomenon, the number of bullshit tasks experienced in 
an organization can be reduced. If the personnel and management together identify 
and analyze the existing bullshit tasks, some of the tasks could thereafter be relabeled, 
moved away, or completely deleted. Some suggestions: 


Relabeling the Task: If some tasks are important, but perceived as non-sense because 
it is not communicated why they need to be done by exactly the persons associating 
them with bullshit tasks, they really are not bullshit tasks. For example, certain 
types of reporting are extremely useful for the people who receive the reports. When 
reports are made and submitted through computer systems, this can result in the 
“black-boxing” of both the receiver and the intentions, thus alienating the sender. As 
was already stated by Karl Marx, it is essential to humans to know the purpose and 
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context of their work [29]. Thus, through educating each other on the value of certain 
tasks and understanding how they are vital for others, some tasks can be relabeled 
from bullshit to valuable tasks. However, the relabeling will not be successful if 
someone tries to relabel a task that really is useless or could be done in a smarter 
way or by another department. 


Moving the Task: Some tasks may be important for the organization, but not neces- 
sarily performed by the personnel that identify them as bullshit tasks. Such tasks 
can be filling in documents or entering information into computer forms. Such tasks 
could be moved to other places in the organization, or in many cases be automated. 
Of course, this generates more tasks, and one should be careful not to generate new 
bullshit tasks. 


Removing the Task: The boldest managers may understand that some of their tasks 
are bullshit, for example defensive documentation in order to satisfy easy audits. 
These tasks can be removed. However, it may demand some work and preparation, 
for example communication with and education of regulators and inspectors and 
internal auditors, to avoid regulative capture and ensuring a shared understanding of 
what is compliance and what is bullshit. It is vital that external actors do not approve 
systems or tasks that obviously are implemented for superficial compliance and not to 
improve operations. This act of removing bullshit tasks in cooperation with auditors 
is a possibility for companies that really look ahead. 

This process most certainly demands a level of maturity of the actors involved. 
What is necessary, what is only defensive documentation, and what is required in 
audits will differ within an organization. Finding out which tasks are perceived as 
bullshit tasks while “really” being useful, may call for discussions and negotiations. 
Personnel could negotiate when to comply and what is really not important to comply 
with. These negotiations would need some form of dialogue between those doing the 
job and the regulators to reveal, on the one side, which audit outputs are necessary 
for the regulator, and, on the other, how any given audit affects the “real work” and 
professional judgment of those doing it. In this scenario, the regulator approaches 
the role of consultant more than that of inspector. 

As a conclusion, we want to underline that this chapter is a contribution toward 
improved management and organizational life. The management methods of orga- 
nizations today are astray. For years, personnel in different industries have seen that 
safety management and quality management also result in something that is not safety 
and quality. In addition to safety and quality, the practice is entangled with bullshit 
tasks, merely adding chores to already full time-schedules. The same picture may 
be drawn for transparency, accountability and now also sustainability, and probably 
many more trendy terms armed with good intentions. We want a world where people 
can experience doing a good job. Today, a more common experience seems to be 
that you almost never do a sufficient job, because you have so many tasks, and some 
of them are not necessary, but they are the ones your management urges you to do. 

Our exploration of the road from reasonable regulation to bullshit tasks is a step 
toward the potential to do a good job. If someone understands how to reduce their 
bullshit tasks, they are probably on the way toward a more reasonable future. 
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Chapter 5 A) 
Ambiguity, Uncoupling, and Autonomy: gts 
The Criminology of Organizational 
Middle-Management 


Paul Almond 


Abstract The criminological study of corporate crime provides a source of insights 
into the key role of middle-managers in navigating the tensions between compliance- 
based and initiative-based approaches to safety. From an initial focus on individual 
and organizational motivations, the discipline has moved to highlight instead the 
influence of breakdowns in the connections between individual and organization. 
Three such grounds of disconnection (problems of ambiguity, structural uncoupling, 
and autonomy deficits) will be explored, and their implications for understandings 
of middle-managers’ role will be analyzed. 


Keywords Middle-management - Criminology - Ambiguity - Uncoupling : 
Autonomy 


5.1 Introduction 


The interrogation of safety-related behavior from different disciplinary perspectives 
can allow for familiar issues to be examined in a new light, and draw attention 
to the organizing assumptions that shape and limit the ways the field of study is 
perceived. While consideration of organizational compliance has traditionally fallen 
within the disciplinary domain of regulatory studies, it has also long been of interest 
to criminologists, whose focus on crime and offending has encompassed a concern 
with rule-breaking within organizational contexts [1]. The criminology of corpo- 
rate offending provides insights into the conditions and circumstances in which 
behavioral “deviance” occurs within organizations, and thus has a lot to offer in 
trying to understand why practices might depart from established rules. Within the 
context of this collection’s focus on the differences between compliance-based safety 
processes (or safety “work-as-imagined”’) and initiative-based safety behaviors (or 


P. Almond (BX) 
University of Leicester, Leicester, UK 
e-mail: paul.almond @leicester.ac.uk 


© The Author(s) 2024 41 
J.-C. Le Coze and B. Journé (eds.), Compliance and Initiative in the Production 

of Safety, SpringerBriefs in Safety Management, 

https://doi.org/10.1007/978-3-03 1-45055-6_5 


42 P. Almond 


safety “work-as-done” [2]), this becomes particularly valuable in thinking about the 
role of individual decision-makers in the shift from one to the other. 

Adopting an approach that starts by thinking about such shifts as a form of 
“deviance” or criminality might seem antithetical to safety science’s prioritization of 
learning-oriented safety cultures over the pursuit of punishment or blame in safety- 
critical settings like healthcare, aviation, and other high-hazard industries [3, 4]. But 
it should be noted that this criminological focus is not solely (or even primarily) 
concerned with criminal deviance per se; rather, because it is acutely aware of the 
constructed and contingent nature of criminalization, it has a broader interest in what 
drives deviations in behavior, such as organizational rule violations, and in the ways 
that this is responded to, via reactions both internal and external to the organiza- 
tion. It is also interested in the interplay between individual motivations (agency) 
and organizational power relations and context (structure) in shaping these behav- 
iors, and particularly in relation to middle-managers. Criminological approaches to 
these issues will be set out, and their relevance to the compliance/initiative debate 
highlighted. Specifically, three analytical themes will be explored: the ambiguities 
of meaning that exist within regulatory processes; the structural uncoupling that can 
occur between individuals and organizations; and the autonomy deficits encountered 
by those who turn imagined work into work done. 


5.2 The Importance of Middle-Management 


It is worth briefly explaining why this contribution has focused on middle- 
management and how this relates to the collection’s focus on the articulation between 
compliance and initiative in safety. Criminology typically takes a subject-oriented 
approach to questions of collective and institutional behavior, drawing on the inter- 
actionist traditions of the discipline [2: 168], and this is reflected in the attention paid 
to both corporate crime as a matter of offending both by and within organizational 
settings, but also to white-collar offending as a form of individualized rule-breaking 
occurring in these settings [5]. This dual model of thinking about “deviant” corporate 
behavior as something that occurs at the intersection of organizational and individual 
action draws the focus toward middle-managers, the critical decision-making individ- 
uals exercising professional autonomy at the intersection of organizational policy and 
practice. Their status as intermediaries who act on behalf of organizations, but also 
as independent actors, makes them a natural locus for assessment of the “work-as- 
imagined/work-as-done” dichotomy. There is a strong tradition of analyzing the role 
of “sociological citizens” who occupy intermediary positions of this sort, particularly 
due to the interactional influence they wield [6]. 

Corporate criminological analysis identifies that organizations are often charac- 
terized by fundamental tensions over the distribution of responsibility and autonomy 
within their structures. This tends to place responsibilities for issues like safety into 
the hands of frontline individual employees and, in doing so, shifts responsibility 
away from the organization itself. At the same time, however, these frontline actors 
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are often not equipped with a level of autonomy commensurate with that respon- 
sibility, and so cannot truly act with authority in the areas that are their respon- 
sibility [7-9]. One result of this is that accountability processes tend to focus on 
individuals and leave deficits at the organizational level. So when we analyze the 
relationship between “work-as-imagined” and “work-as-done”’, we are also interro- 
gating the distribution of responsibility, agency, and accountability, and it is at the 
level of middle-management that these distributions intersect. Initiative-based safety 
behaviors involve the exercise of agency in choosing to depart from compliance with 
established safety policy, but render those who use that agency in order to discharge 
their responsibilities accountable for having done so. 

It is worth mentioning at this point that “compliance” has a different meaning 
in relation to the concept of compliance-based safety (obedience to written rules) 
that forms the basis of “work-as-imagined” than it does in relation to corporate 
criminology, where “compliance” is generally taken to refer to processes of adopting 
flexible, self-determined, self-regulatory measures by organizations in order to meet 
their legal obligations in ways that suit their needs; quite the opposite of following 
prescriptive standards and obligations. Terms like “compliance” and “innovation” 
are thus complex and do not necessarily impose universal value judgements in terms 
of their desirability. So while some criminological explanations of “non-compliance” 
may derive from unlawful offending, their application within the context of “work- 
as-done” need not necessarily judge behavior as “criminal” in the same way. In that 
sense, we are learning from criminological explanations of deviation from formal 
expectation or rules, rather than of crime. 


5.3 Foundations of the Corporate Criminological Tradition 


Two longstanding, and normatively very different, traditions within corporate crim- 
inology have both tended to regard offending behavior as a product of motivation 
and the choices, desires, and interests of those who perpetrate it, albeit that these 
choices are shaped and constrained by social interactions and contextual factors. 
Each approach emphasizes the importance of the choices made by different actors 
to deviate from rules, but interpret those choices in different ways. 


5.3.1 Individual Motivations 


One strand of corporate criminology has drawn on broader individualistic and ratio- 
nalistic “motivational” explanatory factors of human behavior. On this view, manage- 
rial offending results from a failure to contain the tendencies of “bad actors” within 
corporate settings. These actors make rationally informed choices to engage in non- 
compliant, or “deviant”, behavior on the basis of assessments of strategic benefit and 
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the likelihood of detection, but also their internal capacities, including a lack of indi- 
vidual self-control, or capacity to inhibit impulsive and risk-taking behaviors when 
presented with opportunities [10, 11], and of their individual risk factors, such as 
childhood conduct disorders, exclusion from school and structured working oppor- 
tunity [10], or deficit of control in their life [11]. Lastly, elements of personality, 
such as psychopathic personality disorders (resulting in disinhibited, egocentric, 
and manipulative behavior, and a lack of remorse) and anomic reactions to blocked 
opportunities to conform to professional values are also associated with offending 
[1: 170]. 

Rational-choice-based explanations of middle-managerial offending behavior 
suggest that a decision to deviate from a compliance-based approach to safety and 
exercise initiative would tend to derive from the risk-taking, impulsive, and disin- 
hibited nature of the individual who takes that decision; it reflects a tendency toward 
ungovernability and a disregard for, or inability to cope with, authority and supervi- 
sion. Initiative-based safety would thus occur as product of the way that risk managers 
with this type of personality presentation would deal with obstacles, problems, or 
opportunities. At the same time, however, this same “ungovernable” risk-taking 
tendency also predominates among entrepreneurs, political and technological disrup- 
tors, and “innovators” of all sorts, suggesting that the presence of middle-managers 
who take such an approach can be an asset rather than a liability. In any case, indi- 
vidualistic explanations alone fail to explain differentiated distributions of deviating 
behaviors, collective or systemic offending, and how “ungovernable” individuals 
manage to reach positions of workplace authority, suggesting a broader set of factors 
are at play. 


5.3.2 Organizational Motivations 


The antithesis of “bad actor” individual-based explanations are those relating to 
“bad organizations”, which attribute departures from behavioral norms to the self- 
interested tendencies of corporate actors themselves. This represents a more crit- 
ical corporate criminology tradition, regarding organizational offending as a product 
of the criminogenic structural necessities of contemporary capitalism [12], or of 
the influence of industry-wide cultures of motivation, opportunity, and control [13]. 
Clinard’s classic study of middle-management offending identified a range of internal 
corporate factors as drivers of deviant behavior, with the most important being the 
decisive role of top management in setting ethical standards and placing performance 
pressure onto middle-managers [10, 14]. Further, structured anomic discrepancies 
can arise between cultural social norms and the institutional capacity of firms to 
abide by these norms; rule-breaking arises where organizations encounter pressures 
(recession, economic distress, political pressure) that undermine their ability to meet 
the expectations of investors, customers, and the law [15]. In both cases, hierar- 
chical and contextual pressure overrides the capacity of individual actors to exercise 
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moral decision-making in order to achieve organizational goals. Individuals are less 
ungoverned risk-takers, and more victims of the systems they are part of. 

Corporate criminology usually views this dynamic operating in relation to large- 
scale breaches of the law, and as such, tends to be suspicious of regulation and 
business-led voluntarism [1: 170]. But it may also prompt innovation-based responses 
to safety challenges. Organizational motives for (non-) compliance extend beyond 
the “economic rationality” assumed by critical theorists, to encompass normative 
and social drivers such as an internalized commitment to obeying the law (a “duty 
to comply”), and externalized concerns around reputation and the social license to 
operate [16]. Corporate actors follow formal policy and rules because doing so leads 
to the fulfillment of these underlying interests, and so they are perceived as legitimate. 
They depart from rules and compliance behaviors when they are seen as ineffective 
and so illegitimate. On this account, the adoption of initiative-based safety behaviors 
by middle-managers reflects the limits of rules as a means of fulfilling the “best 
interests” of the corporation, either because those interests involve rule violations, 
or because the rules do not work. 


5.4 Connective Factors: Key Insights from Criminology 


As discussed previously, middle-management decision-makers are of particular rele- 
vance to the tensions between compliance-based and initiative-based safety behaviors 
precisely because they occupy an intermediary role, translating hierarchical organi- 
zational requirements into action and formalizing issues identified through front- 
line practice. Most accounts of corporate offending, and of middle-management 
offenders, emphasize the cultural interactions between these two levels of action—a 
clash between the structural and the agentic which gives rise to a culture character- 
ized by disconnections within which deviations from expected behavior can occur. 
Three types of disconnection are identified here, relating to ambiguities of meaning, 
to structural uncouplings, and to autonomy deficits. 


5.4.1 Ambiguities of Meaning 


Middle-managers sit at a “between-point” within organizations, and thus have to 
negotiate meaning as ideas, initiatives, and imperatives pass up and down the hier- 
archy of the corporation. In doing so, these meanings give rise to ambiguities and 
areas of uncertainty, as the gaps between layers of the hierarchy open up, and these 
intermediary actors are charged with closing those gaps. A safety policy may lack 
sufficient detail to deal with a problem encountered in practice, or two different poli- 
cies may contradict one another. For instance, should workers at height follow rules 
about wearing protective eyewear, even in rainy weather when droplets on the goggles 
obscure their vision? Does the safety benefit of non-compliance outweigh the risk 
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that the rule was meant to control? Sometimes ambiguities reflect the presence of 
“principled disagreements” and “incompetence” within firms or in relation to their 
attitude to legal requirements [17], but more often, they emerge from the spaces that 
the autonomy of middle-management allows for—gaps in processes of surveillance 
and reporting, or contestations around what compliance with rules actually entails 
[14: Chap. 8]. Rules create uncertainty, and it falls to intermediary actors to resolve 
ambiguities via processes of “legal endogeneity” which allow for the blurring of 
organizational and legal logics and the complication of compliance [18]. 

Two key points are worth emphasizing. First, ambiguities may be presented as 
if they are unfortunate by-products of complexity, but in actual fact they are often 
manufactured, and sometimes deliberately; ambiguity over the scope and reach of 
a rule, over how it is monitored, and over the way that responsibility for depar- 
ture from it might be attributed, often results from calculated choices on the part 
of rule-makers [1: 174-5]. For example, the Grenfell Tower fire in the UK, where 
a blaze in a high-rise residential block caused 72 deaths, demonstrated that regula- 
tory systems, organizational processes and decisions, and legal rules governing fire 
safety and product approval, were all constructed in ways that sought to increase 
flexibility and reduce regulatory burdens, but also served to disperse responsibility 
and reduce accountability for the decisions that contributed to the fire [19]. Here, as 
elsewhere, middle-managers were partly capitalizing on the gaps to innovate away 
from compliance with safety rules, and partly in filling these gaps with new (and 
more favorable) rules. Second, ambiguities exist at levels above that of tasks, roles, 
and organizations. Those that arise within broader industries, sectors, and regulatory 
contexts play a major role in shaping employee behaviors, as in the example of the 
Deepwater Horizon oil spill [13], where the industry culture implicitly tolerated non- 
compliance with rules and regulations, seeing it as a by-product of doing business 
and so giving rise to ambiguities of motivation, opportunity, and control. 


5.4.2 Structural Uncoupling 


A second connective driver of middle-management departure from rule-compliance 
lies in the structural uncoupling of the goals and interests of the organization 
from those of the individuals within it. In criminological terms, breaches of rules 
arise as an unintentional outcome of the breakdown of organizational dynamics, 
including system inertia, unnoticed breakdowns within complex bureaucratic struc- 
tures, and the “normalization” of offending within the business environment [14, 
20]. Within complex organizational systems, structure and hierarchy create differen- 
tiations between individual and group interests that tolerate or encourage behavioral 
departures. The organization comes to prioritize something that is incompatible with 
the “normal” values of individuals, and may depart from social and legal norms, 
and so individuals are either socialized into identifying with organizational goals 
[10: 537], or have to resolve this difference either by departing from organizational 
values or by reconciling themselves to them. The criminological term for this type 
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of uncoupling is “differential association’, social learning processes through which 
meanings that run counter to formal norms are internalized among individuals within 
that relational context. Differential associations within corporate settings have been 
seen to arise via sociocultural factors, such as gender, organizational identity, and 
organizational cultures [10, 14, 20]. 

Two responses to this type of uncoupling are possible. One is that individuals 
pursue their own values and interests, or those of subgroups that they are social- 
ized into, rather than those of the organization. As an example, individuals within 
functionally- or locationally defined teams or groups may develop their own safety 
practices and ways of working that depart quite radically from the organization’s 
formal safety rules. This might be because those rules are perceived as inadequate 
in reflecting the needs of the job, or the group might “deviate” away from a commit- 
ment to safety altogether. The second type of reaction to differential associations 
is the use of “techniques of neutralization”, or justifications and rationalizations 
that individuals draw on to avoid acknowledging that they are committing acts of 
wrongdoing to fulfill organizational requirements [20, 21]. By rationalizing behavior 
that departs from rules as “normal” for the team/organization/sector, or as harmless, 
or as taken-for-granted organizational practices, individual employees avoid recog- 
nizing their actions as unethical and/or illegal, and reconcile their own beliefs to 
the contextual norms of non-compliance [20, 21]. The uncoupling of individual and 
organizational values creates a space within which behaviors can depart, for good or 
ill, from “work-as-imagined”’. 


5.4.3 Autonomy Deficits 


Lastly, while the granting of autonomy or space to exercise decision-making capacity 
is a defining feature of middle-management, and so links to the presence of ambi- 
guities and uncouplings, it also acts as a driver of behavioral deviation by virtue of 
its absence. Flexibility and accountability exist in a tension within organizational 
and regulatory systems [22]; the appropriate allocation of autonomy is necessary to 
ensure that operational individuals are empowered to take decisions and respond to 
problems, but that these decisions are appropriately owned by, and subject to the 
oversight of, the organization. Middle-managers with safety responsibilities gener- 
ally possess agency to go beyond their immediate contexts and to experiment and 
adapt in order to fulfill their professional roles; they must be aware that they have 
the capacity and the authority to do so, and they must have dialogic relationships 
with organizational systems that are responsive to, learn from, and take ownership 
of, their actions in order to manage safety risks appropriately [6, 7: 9]. But while 
autonomy is central to the successful operation of complex systems, it also presents 
risks to organizations and so tends to be managed closely. Organizational desires for 
internal accountability and external legitimacy both serve as drivers toward the use of 
mechanisms such as audit and monitoring, and certification or standardization, that 
curtail autonomy and exercise power over individual action [23]. One result of this 
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quest for control is that individual managers may not possess the authority needed to 
perform the role they are responsible for; departures from compliance with formal 
rules arise as a means of getting things done within the restrictive parameters the 
organization sets. 

More significantly, because these processes of accountability focus on the visible 
measurement and signaling of attitudes of compliance with law and commitment 
to safety discourse, they turn the exercise of individual autonomy into an issue of 
responsibility —and subsequently view “work-as-done” and initiative-based behavior 
as managerial deviance rather than as reflective of systemic or structural issues 
[7-9]. The reasons for departure from rules are smoothed away, and individual deci- 
sions are purposely not “owned” by organizational procedures and policies, because 
to acknowledge complexity and “real problems” in the work environment would 
undermine organizational claims as to certainty, control, and legitimacy [23: 1028]. 
Crucially, while middle-managers are given responsibility for operational perfor- 
mance and outcome delivery, and bear individual accountability for failures and 
breaches of rules, they are not given the authority or capacity to fulfill these roles 
and may be disavowed by the organization when they do; this hierarchical distance 
insulates managerial levels of the organization from similar exposure to responsi- 
bility for risk at the front line [7: 14]. Prosocial rule-breaking also reflect the same 
processes of “responsibilization” and insulation [8]; going “beyond compliance” to 
implement higher standards than required, acting as a whistleblower to externalize 
concerns about non-compliance, and acting as regulatory intermediaries to imple- 
ment requirements at the local level, reflect the same absence of autonomy within 
the middle-manager role [6]. 


5.5 Conclusion 


The crucial lesson about “work-as-done” and “work-as-imagined” to be taken from 
criminological research is that departures from formalized rules, regulations, or 
practices occur as a result of the ways that individual and organizational factors 
interact within our prevailing regulatory governance culture. Flexibility, diffusion, 
and empowerment are central to the creation of embedded, self-regulating safety 
cultures and practices, but they also create ambiguities of scope, structural uncou- 
plings, and autonomy deficits. Responsibility for compliance and rule-following are 
distributed downward to the levels of the organization where knowledge and involve- 
ment are pooled and where implementation can be effectively owned (decisions 
should be made at the “lowest competent level”). But across all three of these head- 
ings (ambiguity, uncoupling, autonomy), the responsibility that middle-managers are 
given for the implementation of safety management is restricted by the constraints 
that organizational power structures introduce. Oversight methods such as layered 
systems of audit and monitoring, create conditions for ambiguity and uncoupling 
(between practice and reported practice) to exist, and contain responsibility for them 
at the operational level and in the hands of middle-managers [23]. And processes of 
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accountability-allocation locate responsibility for departures from policy and rules, 
as well as failures and deviations from safe practice, at lower levels of organizations, 
while the authority and autonomy to exercise responsibility effectively are retained 
at the top-tiers [7]. It is the failure of organizational power structures to integrate 
these levels that leads to middle-management rule deviation. 
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Chapter 6 R) 
The Effects of Top Managers’ get 
Organizational Reliability Orientation 


Rangaraj Ramanujam 


Abstract The implicit theories that top managers hold about organizational reli- 
ability potentially exert strong effects on how frontline employees approach the 
task of managing reliability and, hence, on reliability-linked outcomes. Specifically, 
such implicit theories (“orientation” for short) can be thought of as varying along a 
continuum ranging from modular at one end to systemic at the other. A more modular 
orientation leads to a stronger organizational emphasis on strict compliance, whereas 
a more systemic orientation emphasizes local initiative by enabling employees to go 
“above and beyond” formal rules when appropriate. I describe the two ends of the 
continuum and their implications for organizational reliability. I then point out recent 
trends that warrant a shift toward a systemic orientation across industries and discuss 
some initial implications for research and practice. 


Keywords Organizational reliability - Compliance - Resilience - Top 
management teams 


6.1 Introduction 


The escalating societal dependence on organizations for critical services and prod- 
ucts brings into question, especially in the wake of major accidents, the dependability 
of organizations. As a result, organization capability to reliably operate risky tech- 
nologies under challenging conditions remains a major topic for research, policy, and 
practice [1]. As used here, organizational reliability encompasses multiple distinct 
and related concepts such as performance consistency, service continuity, safety, 
recovery, and resilience [2]. It refers to the organization’s ability to continuously 
provide a critical set of products or services of predefined quality without disruption 
by intentionally managing the risks to the safety of processes and people within and 
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without the organization. In addition, it also refers to the organizational ability to 
respond to and recover and learn from adverse events [3]. 

Researchers from multiple disciplines continue to investigate the antecedents and 
consequences of organizational reliability. Given the intensely local nature of the 
activities that constitute reliability management, much of this research has under- 
standably focused on the immediate or local context for hazardous operations. That 
is, most studies have tended to focus on the characteristics of technologies and of 
the people and teams that operate them. In doing so, however, a key aspect of the 
organizational context has received relatively less attention—top management teams 
(TMT) or the group of influential executives at the apex of an organization, i.e., the 
CEO and their direct reports. By widening the focus from individual leaders to 
the senior leadership group, this term captures the reality that top management is 
typically a shared activity [4]. 

The limited attention to the role of TMTs in enabling organizational reliability 
is surprising given that several organizational studies suggest that top management 
can exert strong effects on the choices and actions of frontline teams and employees 
[5], and, hence, organizational reliability. These effects come about by the choices 
of top management in setting strategic agenda that in effect conveys the ordering 
of organizational priorities including reliability management, allocating resources 
including attention, designing the formal organization and incentives, and enacting 
the organizational culture. 


6.2 Method 


Drawing on my research and consulting work around patient safety with top manage- 
ment teams in US hospitals over the past two decades [6], I propose that “implicit 
theories” that top managers hold about organizational reliability have a significant 
impact on how frontline employees approach the task of managing reliability and, 
hence, on reliability-linked outcomes. Specifically, I argue that such implicit theo- 
ries (“orientation” for short) can be thought of as varying along a continuum ranging 
from modular at one end to systemic at the other. Further, a more modular orien- 
tation leads to a stronger organizational emphasis on strict compliance whereas a 
more systemic orientation emphasizes local initiative by enabling employees to go 
“above and beyond” formal rules when appropriate. I describe the two ends of the 
continuum and their implications for organizational reliability (Table 6.1). I then 
point out recent trends that warrant a shift toward a systemic orientation across 
industries and discuss some initial implications for research and practice. I offer 
these comments as speculative hypotheses to stimulate discussion at the workshop. 
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Table 6.1 Features of TMT orientation toward organizational reliability 


Shared assumptions about... Modular/Operational Systemic/Strategic orientation 
orientation 

Operations Stable, unchanging, and Dynamic, evolving, and 
uninterrupted disruption-prone 

Work Complex; rarely uncertain or | Complex; frequently uncertain 
ambiguous and ambiguous 

Interdependence Formal coordination is Informal collaboration is also 
adequate necessary 

Risk Rules, incentives, and Improvisation is also 
supervision are adequate necessary 

Reliability in relation to other A standalone lower priority | An interconnected co-equal 

priorities priority 

Frontline rule-related actions Reliability is the result of Reliability is the result of a 
unvarying compliance mix of compliance and 

initiative 


6.2.1 TMT Organizational Reliability Orientation 


My core premise is that TMT’s choices and actions profoundly shape the organiza- 
tional pursuit of reliability in ways that are insufficiently understood and, therefore, 
warrant further research. In particular, top managers’ shared orientation toward orga- 
nizational reliability (i.e., their shared understandings or mental models about what 
is needed for an organization to be consistently reliable) can exert strong yet invisible 
effects on the rule-based actions of frontline employees. This orientation, which is 
typically implicit, often differs from what TMT might explicitly espouse. Speaking 
of the TMT in her hospital, a nurse told me, “I know the senior leaders genuinely 
care about patient safety. I just don’t think they get it though”. She elaborated, “they 
keep saying the right things like safety is everyone’s responsibility. But everything 
they do when something goes wrong screams that they actually believe that it is the 
responsibility of a few people”. Therefore, organizational reliability orientation is 
best inferred from TMT’s observable patterns of behaviors, e.g., the metrics they 
attend to regularly and their response to adverse events. 


6.2.2 Modular Orientation 


The following are some of the key assumptions underlying what I call a modular 
(or subsystemic) TMT orientation toward organizational reliability. Examples in 
parentheses refer to corresponding observable TMT choices and actions as reported 
by lower-level employees. 
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Operations are highly stable and routinized (e.g., emphasis on rule making and 
standardization; rules and process-related and outcome-related metrics reviewed 
by TMT rarely undergo revisions) 

Work can be highly complex, but it is unlikely to be highly uncertain or highly 
ambiguous (e.g., reliance on large set of very specific rules and SOPs to manage 
complexity; exceptions are treated either as a variation that can be costly or as 
a violation that can expose the organization to risk; employees infer this from 
how TMT asks only about how to prevent recurrence, and not about whether the 
exception was justified) 

Interdependence can be adequately managed through formal coordination mech- 
anisms such as schedules and protocols (e.g., absence of any visible efforts to 
encourage collaboration) 

Reliability is an individual responsibility (e.g., reflexive TMT questions about 
“who is accountable?” whenever there is an adverse outcome that strongly suggest 
that they are looking for a few specific names) 

Risks can be proactively managed through incentives and supervision (e.g., 
linking extrinsic rewards to meeting “safety targets”; performance evaluations 
discuss instances of employee non-compliance with rules) 

Growth, profits, and innovation represent more pressing priorities than organi- 
zational reliability (e.g., responsibility for reliability-related outcomes such as 
safety, quality, or risk management are assigned to lower-ranked persons in the 
organizational chart; reliability-related metrics are monitored less frequently by 
TMT compared to financial metrics; less time is allocated to discussing reliability 
during TMT meetings). 


6.2.3 Systemic Orientation 


The following are some of the key assumptions underlying what I call a systemic 
TMT orientation toward organizational reliability: 


Operations are dynamic, evolving, and subject to disruptions (e.g., regular review 
and revisions to metrics that are reported to TMT, not infrequent changes to rules 
and SOPs) 

Work is not only highly complex, but can occasionally also be highly uncertain 
and ambiguous (e.g., exceptions are treated as inevitable features of the nature 
of work and used to revise rules and protocols including dropping some rules if 
necessary; TMT response starts with “why did the employee deviate from the 
rule?”) 

Managing interdependence requires both formal coordination mechanisms as well 
as informal collaboration (e.g., TMT efforts to create psychologically safe envi- 
ronments to encourage information sharing; relying on incentives beyond extrinsic 
rewards to encourage employees go “above and beyond” the requirements of their 
formal roles and rules) 
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e While many risks can be proactively managed, some risks will require impro- 
visational response (e.g., greater autonomy to frontline employees, reliance on 
guidelines rather than on overspecified rules, TMT praise for employee initiative 
that comes to their attention) 

© The pursuit of reliability co-occurs with the pursuit of other potentially conflicting 
organizational goals such as growth, profits, sustainability, and innovation, and 
with other organizational pressures such as speed, efficiency, and costs (e.g., 
discussions about reliability-related issues rarely occurs in isolation nor limited 
only to people directly tasked with managing reliability; people at all levels discuss 
reliability in tandem with other objectives). 


TMT orientation varies along this continuum ranging from modular to systemic. It 
potentially affects organizational design, performance measurement and incentives, 
and incident investigations in ways that can either widen or bridge the gap between 
how frontline employees experience work demands and how they can respond to such 
demands. For instance, a modular TMT orientation makes it more likely that the orga- 
nizational design will tend toward the mechanistic (i.e., high formalization, standard- 
ization, and centralization), supervisors will emphasize rule-following, safety might 
more likely be relegated to the status of a lower-level operational concern that is 
monitored infrequently if at all by TMT. It is conceivable that in many settings such 
an orientation might not have any significant adverse effects on reliability. Indeed, 
in many settings a modular orientation can perhaps even enhance organizational 
reliability. 

Several basic questions arise in the wake of this framing: Do these assumptions 
generally hold together as a coherent orientation as they do in our sample? How is the 
TMT location on this continuum related to outcomes linked to organizational relia- 
bility? What can account for why some TMTs are nearer one end of the continuum 
than the other? If a more systemic TMT orientation to organizational reliability is 
preferable as suggested by our qualitative work, how costly is it? Is TMT orientation 
outlined above related to the different context-specific safety models? 


6.2.4 The Case for a Systemic Orientation 


Based on data from a small sample of TMTs from a self-selected set of hospitals that 
espouse strong commitment to patient safety, I would expect a significant majority 
TMTs in US hospitals to cluster toward the modular end of the continuum. If that’s the 
case, it suggests that most hospital TMTs overemphasize compliance and constrain 
local initiative even when such initiative does not violate any regulatory or evidence- 
based guidelines but is critical for reliability. 

However, several recent trends call for an increasingly initiative-driven approach 
to organizational reliability, i.e., an urgent shift toward a more systemic TMT orien- 
tation. First, the growing turbulence and disruptions in the post-Covid world as 
evidenced by sudden changes in employee work expectations and turnover shows 
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few signs of abating or sparing any industry. Therefore, even industries that were 
operating in relatively stable task environments suddenly face the need to encourage 
their employees to adapt by improvising if necessary (“do more with less”). Second, 
public intolerance for organizational errors and lapses continues to intensify. Health- 
care veterans talk about how simple non-harmful medication error that would have 
been dismissed as a normal part of delivering care even as recently as ten years ago 
is more likely to be viewed as unacceptable. In other words, the margin for error in 
shrinking. Third, the advent of social media has dramatically accelerated and ampli- 
fied the costs of even small mishaps. As a result, even as the margin for error keeps 
shrinking, the potential costs of smaller errors keep rising. 

Fourth, even as the above trends impose higher expectations about organizational 
reliability, organizations are being increasingly held to multiple standards rather 
than to a single metric such as earnings or stock value. Consider healthcare delivery. 
Effective care is defined as care that is at once safe, efficacious, efficient, equitable, 
timely, and patient-centered. The emergence of ESG is another example that now 
requires organizations to pursue multiple competing priorities while also operating 
reliably. In short, organizations are expected to become even more reliable even as 
they are evaluated on other priorities. Compliance-driven organizing is unlikely to 
meet these demands. 

Finally, and especially in the US, there appears to be a rising chorus of calls for 
“organizational accountability” in the aftermath of major accidents. A particularly 
dramatic example was the deadly explosion of a gas pipeline operated by PG&E in 
San Bruno. NTSB’s investigation concluded that this was “an organizational acci- 
dent” thereby forcing the media and the courts to ponder about what it means to 
causally attribute an accident to an organization. In a subsequent unrelated court 
ruling involving a wildfire set off by faulty PG&E equipment, the company was 
held criminally negligible. Such rulings, at least in the USA, portend a quick shift to 
assigning primary agency to organizations rather than to its individual employees. A 
modular TMT orientation toward organizational reliability seems difficult to defend 
from a legal perspective. 

Given the need for a shift in TMT orientation, it is perhaps useful to briefly 
consider what can account for prevalence of a modular orientation. As a business 
school professor who has taught MBA students and executives for over two decades, I 
would start with how managers are taught and trained especially in business schools. 
Simply put, management education is essentially silent about organizational relia- 
bility. The implicit assumption seems to be that understanding organizational relia- 
bility is not critical to becoming a business leader and that organizational reliability 
will be managed by “non-managerial” specialists. Similarly, academic courses on 
organizational design focus almost exclusively on designing for efficiency, inno- 
vation, and agility. Moreover, several courses in finance and economics routinely 
emphasize individual agency and the primacy of incentives, formal rules, and metrics 
for managing coordination and performance. As aresult, holding individuals account- 
able for adverse outcomes is almost a reflexive response even when such actions are 
carried out in the context of interdependent teamwork. 
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Another reason could be that most TMTs remain psychologically distant from the 
operating core, the frontlines of organizational reliability [7]. Psychological distance 
includes temporal distance (when something happens), spatial distance (where it 
happens), social distance (to whom it happens), and hypothetical distance (whether 
it is likely to happen). High psychological distance can cause TMTs to view relia- 
bility in abstract terms rather than in concrete terms and in ways that reinforces a 
modular orientation. As a result, TMTs might pay attention to the details underlying 
organizational reliability only when things go wrong. In other words, TMTs with a 
modular orientation often think about organizational reliability only in response to 
things going seriously wrong and that too in the context of emotion-laden and lawyer- 
guided discussions about costs, risks, and accountability. Behaviors with respect to 
pre-existing rules become the basis for analysis and the response and the learning 
tend to reinforce the importance of compliance. 


6.2.5 Toward a Systemic Orientation 


Shifting TMTs toward a more systemic orientation presents challenges and oppor- 
tunities for research and practice. How can we get TMTs to revise their assumptions 
about the nature, significance, and the practice of organizational reliability? Foun- 
dational to addressing this question is gaining a better understanding of the roles 
that TMTs in the enactment of organizational reliability. Although several studies 
have identified the importance of “top management support” and “top manage- 
ment commitment” for aiding the frontline staff, much remains unknown about the 
conditions under which some TMTs simultaneously promote compliance as well as 
initiative. 

Equally, there is an urgent need to develop training programs for TMTs and their 
boards about enabling, enacting, and enhancing organizational reliability. Addition- 
ally, organizational reliability needs to be incorporated as an essential component of 
general management education. Another option, which we explored in one of our 
studies, is to periodically reduce the psychological distance of TMTs by creating 
opportunities for them to first-hand observe and perhaps even experience the chal- 
lenges of managing organizational reliability. Finally, it is important to figure out 
ways to routinely link discussions of reliability to competing priorities especially 
costs. For example, in healthcare, discussions of quality and safety of care typically 
proceed without reference to costs, the reduction of which is right at the top of the 
agenda of most hospital TMTs. Efforts to reframe the discussions around the notion of 
value (outcome per dollar spent) accompanied by other enabling interventions (e.g., 
integrated organizational units, more relevant metrics) show some initial promise in 
helping providers to simultaneously improve quality (including patient safety) while 
also reducing costs. A key takeaway from these studies is that linking quality and 
costs can lead to a more flexible and collaborative approach to rule-following. 
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6.3 Conclusion 


Top management teams exert important yet understudied impact on organizational 
reliability broadly defined. A particularly important avenue for research is examining 
the role of TMT orientation in positioning the pursuit of organizational reliability in 
reference other organizational priorities such as growth, innovation, sustainability, 
and profits. In other words, under what conditions does organizational reliability 
emerge as a strategic, not just an operational, priority? 


Ethics Statement Informed consent was obtained from informants interviewed for this work, 
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Chapter 7 A) 
Interlocking Surprises: Their Nature, get 
Implications, and Potential Responses 


Moshe Farjoun 


Abstract Safety organizations need to manage their working conditions contin- 
uously and effectively while dealing with constant surprises [1]. This chapter 
calls attention to an increasingly prevalent phenomenon, which I term interlocking 
surprises. While not completely new, this phenomenon is not fully understood 
and carries significant implications for research and practice. In conceptualizing 
interlocking surprises—their nature, implications, and potential responses—my 
aim is rather simple. It is, to paraphrase social theorist Norbert Elias, to take 
some steps toward developing the conceptual models and overall vision by which 
we—academics and practitioners—can make comprehensible in thought what we 
experience in our everyday realities [2]. 


Keywords Surprises - Disruptive innovations - Ecology - Overlapping crises - 
Process ontology 


7.1 The Nature of Interlocking Surprises 


I originally coined the notion of interlocking surprises in 2018 to characterize several 
interaction patterns that I observed in my research on the turbulent smartphone 
industry around the 2007 introduction of the iPhone. Briefly, some actors in the 
industry experienced several consecutive and cumulative surprises, both internal and 
external to their organizations, some of which were responses to their own previous 
surprising moves. While I will refer to this business context on occasion, I found 
the following recent quotations particularly useful for introducing the topic to safety 
audience: 
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1. “This is what living with climate change will look like: Not just an epic, Katrina- 
or Sandy-scale catastrophe every few years (though probably that, too), but a 
relentless grind of overlapping disasters [italicization my own], major and minor. 
The number of disasters that FEMA is handling is about twice what it was three 
years ago ....” [3]. 

2. “The traditional disaster management cycle had a rhythm of prevent, prepare, 
respond, recover (known as PPRR), with breaks in between to rest and recuperate, 
but lately we’ve experienced a constant COVID event with an overlay of flood 
and fire [italicization my own] that is essentially merging” [4]. 

3. “We have been confronted with a series of crises, one more grave than the other,” 
[italicization my own] President Macron said in a televised speech to the nation 
late last month. “The picture that I’m painting is one of the end of abundance,” 
he added. “We have reached a tipping point.” [5]. 


These diverse commentators—and others from business, government, and 
academia—call attention to emergent developments that they observed or experi- 
enced, as well as to the intersections of these developments. These developments 
involve unexpected elements and demonstrate parallels in accounts of discoveries 
and innovation, such as the emergence of ChatGPT [6]. For this reason, I refer to them 
through the more neutral term “surprises”, as opposed to other related terms, such 
as crises or disruptions. Indicating gaps between expectations and reality, surprises 
occur mainly when the expected does not happen and the unexpected does instead 
[7]. Beyond being surprising, these developments often display other features, such 
as being complex and interlocking, evolving, recursive, multiplex, cumulative, and 
nested. I refer to them simply as “interlocking surprises”, a term that seems to resonate 
with both academic and practitioner audiences and which I define below. 

The concept of interlocking surprises refers to sudden, unexpected develop- 
ments that are potentially interlinked in space (e.g., across several industries, nations, 
geographies, or spheres—such as political or economic), in time (e.g., one surprise 
overlays or leads to another, or to several), or in scale or level (e.g., a surprise external 
to an actor that leads to a surprising self-discovery, or a local surprise that constitutes 
a microcosm of a broader failure). 

Consistent with contemporary views on ecological surprises [8], interlocking 
surprises describes and helps explain how surprises (and related notions, such as 
disruptions) evolve, circulate, and compound in an ecology of action. For instance, 
the March 2011 tsunami in Japan subsequently led to an earthquake, followed by 
a crisis at Japan’s Fukushima nuclear power plant, and then to a subsequent cover- 
up of an alarming increase in local radiation levels so as to not interfere with the 
2020 Tokyo Olympics. Similarly, the COVID-19 pandemic—which is still not fully 
behind us—involved multiple waves of infections, new variants emerging on a regular 
basis, successive lockdowns, growing civil unrest, and international tensions. When 
the tsunami happened, nobody predicted its potential downstream effects; similarly, 
when COVID-19 began to spread, its social and political consequences were largely 
unforeseen. 
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As these examples illustrate, interlocking surprises can vary in form and degree 
alike. We know relatively more about a single or “bounded” surprise affecting a focal 
organization, such as when an infrastructure company needs to combat a security 
breach. Once we move from this baseline example, we enter the realm of “inter- 
locking surprises” in which there are few subcases about which we know less. A 
relatively known instance of this phenomenon involves a focal organization encoun- 
tering several surprises simultaneously: A perfect storm (looking at space). Another 
case involves surprises affecting a focal organization when these evolve and are 
concatenated, cascading, or escalating (looking at time); or when an organization is 
both an instigator and recipient of surprise (looking at scale). While such develop- 
ments are often causally related, our formulation extends to cases where they simply 
co-occur, yet are experienced as interlocked by the recipient system or organization. 

Furthermore, each of the above cases can also involve multiple and potentially 
interconnected systems or organizations. Here, too, we know relatively more about 
how such networks may be affected by a relatively “bounded” development—a 
common cause of failure, such as a cyber-attack—but less on how they address inter- 
locking surprises over time or scale. To be sure, these different forms of surprises, 
either bounded or interlocked, do not necessarily imply a particular degree of 
severity—a single “bounded” but extreme surprise or disruption, or a very rapid 
sequence of repeated “small” developments, may overwhelm a focal system; in 
contrast, multiple but mild overlapping surprises over time may not. Furthermore, 
interlocking surprises may cancel each other out rather than reinforce one another. 

The ecological concept of interlocking surprise reflects a new ontology of surprise: 
It highlights surprise as indicative of a process rather than a discrete episode, and as 
a relationship embedded in complex networks of beliefs and practices as well as in 
feedback loops rather than a linear and atomistic or isolated event. 

In terms of process, interlocking surprises often feature an event chain—i.e., a set 
of events that are temporally and causally connected. These events and developments 
may occur or incubate prior to the onset of the surprise and in its aftermath (e.g., 
grasping its significance and downstream effects and the possibility of an adaptive 
or morphing threat or opportunity), and subsume “perfect storms”, or multilateral 
developments, as special cases. In contrast to viewing surprise as a reaction, where 
it is bound to a few seconds, viewing surprise as a development extends to a much 
longer period.! 

The concept of relationality stresses surprise as a “moment” in ongoing interac- 
tions, as a circuit rather than a stimulus—response sequence, and as a struggle rather 
than a disruption. 

Thus defined, the notion of interlocking surprises highlights a key dimension of 
turbulent environments related to but distinct from dimensions such as the speed 
and amplitude of change, uncertainty, and non-linearity. It differs from standard 


' For many purposes—both analytical and practical—there are advantages to viewing surprise as 
a process or development. Noticing an unexpected event, understanding its potential significance, 
devising an effective response to it, and carrying it out—these phenomena do not occur at once. 
While they may overlap, each phase has its own duration and should be considered to be part of the 
same whole. 
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accounts of change as either being gradual or featuring a punctuated equilibrium: 
Whileitinvolves discontinuities, importantly, these are experienced as being overlaid 
rather than appearing episodically. As such, there is no stable or dull moment. 

Interlocking surprises are a particularly timely concept. Surprises, shocks, unex- 
pected strategic shifts, and disruptions can happen in relatively serene settings. 
However, they are more likely to happen as organizational environments are increas- 
ingly characterized by multilateral competition and conflict, complex yet fallible 
products and platforms (e.g., smart cities, the Internet of things, and autonomous 
cars), rapid-onset climatic events, digital convergence, and the blurring boundaries 
of industries and fields. 

While these and other systemic features of contemporary environments are likely 
to normalize surprises, they also make it more likely that surprises will interlock with 
one another rather than occurring as localized, singular external events compressed 
in time. The growing interconnectedness within and between humans and devices, 
in addition to the tighter coupling of humans and their natural environment, will 
provide further opportunities for applying the notion of interlocking surprises as a 
descriptive term, an explanatory device, and a boundary object for communities of 
practice. Treating surprise as an isolated, linear phenomenon may no longer suffice. 

Finally, salient developments, such as rapid-onset climate change and the COVID- 
19 pandemic, have sensitized us to the interlocking nature of surprises as well as to 
their potential to devastate existing systems, test their limits, and bring them to a 
halt. Often, these salient developments are viewed as root causes for subsequent 
interlaced developments. However, from a broader ecological perspective, this root 
cause attribution may not be as straightforward as it appears. For instance, as research 
has shown, the anthropogenic destruction of wildlife and natural ecologies for agri- 
cultural purposes can contribute both to climate change and—through their transmis- 
sion by animals—to a faster spread of diseases and pandemics. Similarly, while they 
experience surprises and shocks, organizations such as nuclear plants and gas infras- 
tructure entities may also act as agents or conduits of calamities to other affected 
parties. 


7.2 Key Implications 


Interlocking surprises heighten several distinctive and interrelated considerations 
beyond those imposed on organizations by simpler surprises: 


1. Operating at or Beyond Limits: Any system, even a relatively robust one, has 
limits; when it experiences environmental variation outside its tolerance, it can 
become vulnerable or brittle [9]. Capacity is particularly stretched when surprises 
build on one another either spatially or sequentially, turning local crises into 
global ones. Extreme developments—and particularly the so-called “compound 
extremes’—are challenging, as systems are not designed to meet them; therefore, 
they may lead to a tipping point, a breakdown, or a painful restructuring. 
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2. 


Complicated Resource Allocation: A central challenge inherent to disaster 
recovery is the need to address short-term needs quickly, but with sufficient 
foresight to avoid creating new (or worsening existing) long-term vulnerabili- 
ties. Policies, rules, and models concerning a current salient threat or surprise 
may limit the allocation of resources needed for longer-term (and yet uncertain) 
challenges. Organizations often design reliable capabilities aimed at addressing a 
typical challenge, and these designs may lead them to view upcoming challenges 
as akin to the wars or issues they are accustomed to fight.” A myopic focus may 
also lead to under investment in longer-term strategic response capabilities (such 
as responding to the current energy crisis in ways that undermine investment 
in renewable energy). Furthermore, due to uncertainty, leaders face one of the 
toughest decisions any general has: when to deploy the reserves (assuming they 
exist). 

Politicians, too, must prioritize resource allocation across multiple systems. In 
addition to the known tradeoff between production goals and safety or mainte- 
nance goals, leaders may increasingly need to allocate even scarcer resources 
across multiple overburdened systems and to be able to better discern, in 
the context of widespread complexity, any potential errors of omission and 
commission. 

Strained Attention Allocation: Attention is a scarce key resource that profes- 
sionals and leaders alike need to allocate. Our mental models are accustomed to 
serial processing; however, multiple, simultaneous, or cumulative developments 
can lead to divided attention, attention deficits, and derivative blind spots, partic- 
ularly since there is no central entity that can sense, address, and respond to them. 
Prioritizing, too, becomes more difficult when organizations face several inter- 
twined surprises. Furthermore, managers often associate surprises with external 
events and developments. However, surprises also emerge within organizations 
due to factors such as complexity, underinvestment, skill decay, inadequate main- 
tenance, and turnover; or—in the case of a network of organizations—because 
of fault lines between different parties. This added internal focus may further 
strain decision-makers’ attention and resource allocation. 

Ineffective or Narrow Response Repertoires: Due to uncertainty and igno- 
rance, decision-makers may not be in the best position to allocate resources 
effectively. This deficiency may be exacerbated when surprises morph and adapt. 
Organizations may also lack the skills and capabilities needed to address new 
types of surprises (such as when cyber-attacks became prominent). Furthermore, 
when surprises and crises escalate and exhibit nonlinear, multiplicative dynamics 
rather than additive effects, there may be a tendency to underestimate the extent 
to which and speed with which the system needs to respond, and a potential 
for runaway or avalanche dynamics. Similarly, the way surprises are interlinked 
may not be fully understood, which can lead to unanticipated outcomes and over- 
looked side effects. When multiple disasters occur in quick succession, periods 


? See, for instance, the tragic Germanwings Flight 9525 incident. 
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of response, recovery, and preparation for future risks may take longer than 
originally expected. 

Incomplete Learning Cycles: When surprises and crises pile up, organizations 
and individuals do not have enough time to reflect and learn from their successes, 
failures, or near-failures. As a result, new rules and practices may be added ad 
hoc and patched without adequate testing of their relevance and effectiveness. 
Some lessons remain unheeded and are not fully absorbed. 

Shifts in Boundaries and Charters: The potential blurring of challenges and 
surprises may require organizations to adjust previously stable interorganiza- 
tional (as well as intra-organizational) boundaries and charters. For instance, 
a rescue organization designed for combating fires and flooding may need to 
reconsider divisional jurisdictions when these two types of disasters overlap. 
Moreover, intelligence services used to view terror attacks and enemy plans as 
their main charter; now, they understand the need to include phenomena such as 
the spread of famine and the climate crisis as important parts of their agendas. 
Similarly, several previously disconnected organizations may be required to coor- 
dinate their responses to tackle common disasters. Boundary issues also occur 
since instigators of surprise often target the interfaces between established juris- 
dictions. Furthermore, as they impinge on traditional specialties, boundary shifts 
also impinge on the safety function within organizations, requiring them to revise 
their charters. 

Resource Decay and Organizational Fatigue: Accumulated stress leads to 
eroding organizational resilience and increased fragility. This erosion can mani- 
fest itself through fatigue, burnout, paralysis, despair, and the associated losses 
of trust, alertness, and mindful responses. Furthermore, redundancy measures 
which ordinarily help with recovery and facilitate flexible responses may dry up, 
leaving the focal organization exposed with fewer degrees of freedom, margins 
of error, and lines of action. When individuals do not see the light at the end of 
the tunnel, they feel less in control and can become cynical and demoralized. 
Consequently, organizations increasingly approach an upcoming surprise, crisis, 
or disruption with a deficit rather than a surplus of resources. 


7.3 Potential Remedies 


Received wisdom suggests that given economic, technological, and political factors, 
a foolproof and robust system is an idealized rather than a real possibility. While 
interlocking surprises do not lend themselves well to easy solutions, recognizing 
their nature and increasing awareness of the distinct challenges they present are 
important first steps. 


Beyond this, one can consider two broad and complementary strategies for miti- 


gating the potentially negative effects of interlocking surprises: (1) building requisite 
variety and (2) employing smart solutions. Each of these umbrella strategies—as well 
as the more detailed solutions they encompass—needs to be evaluated with caution: 
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One needs to specifically consider their feasibility, potential downsides, and the 
possibility of their interacting with other solutions. 


7.3.1 Building Requisite Variety 


In this first broad approach, the focal organization or system attempts to build in the 
requisite variety needed to address the unique challenges presented by interlocking 
surprises (in addition to those presented by “simpler” surprises). 


1. 


Anticipation, Mapping, Sensing: Organizations and individuals can use tools 
such as system dynamics, event system models, dynamic simulations, and graph 
theory to form visual and even dynamic representations of how different surprises 
are linked across space, time, and scale. For instance, graph theoretical models 
may be used to distinguish between developments that affect other developments, 
that are affected by other developments, or both. Scenario construction expands 
managers’ horizons from a linear “official future”, which may fit recurrent or 
bounded surprises, to different alternative futures in which uncertainties and 
surprises are combined (e.g., both COVID-19 and terror attacks). This technique 
also turns attention to “wild cards” in the form of relatively unknown types of 
surprises. Scenario planning and other methods, such as pre mortem analysis, 
can then help identify the capabilities and responses needed to deal with these 
future contingencies and their differential proneness to failure. These anticipatory 
measures may then be reinforced in training programs and drills particularly 
designed to address interlocking surprises. 

Viewing surprises as interlocking also opens up the possibility that a focal 
firm might be able to better prepare itself by observing the responses of other 
actors affected by surprising developments either in adjacent settings or at an 
earlier time. 

Organizations may also use “issue management” systems that help them 
monitor newly unfolding developments in real time, categorize them, and priori- 
tize them according to their immediacy, expected duration, and anticipated degree 
of severity. It may be particularly useful to consider the image of “living docu- 
ments” that are continually revised and updated. This image, best exemplified in 
an online version of a news or media article that can be amended on an ongoing 
basis, may help promote dynamic monitoring and more flexible forms of agenda 
setting and resource allocation. 

Structural Solutions: Interlocking surprises require better coordination within 
and across organizations, as well as the ability to use temporary organizing to flex 
boundaries quickly. Premised on overlap, some types of organizational arrange- 
ments—such as matrices, loose couplings, and heterarchy—may be consid- 
ered as means for coping with the complexity associated with interlocking 
surprises. To better prepare for the unexpected, organizations need to cultivate 
solutions beyond a mere sense of paranoia. The latter can be institutionalized 
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in organizational mechanisms, such as red teams and other forms of organized 
contestation. 

Resources, Skills, and Capabilities: Interlocking surprises require a broader 
menu of skills and capabilities. When these are not immediately available, they 
require the development of new ones, either internally or through alliances with 
other organizations. Organizations also need to be able to mobilize resources 
rapidly, allocate them across different time scales, and recombine and repurpose 
them. Furthermore, due to the cumulative nature of interlocking surprises, some 
resources and capabilities may atrophy only to be needed again at a later point 
in time. For this reason, organizations need to exercise caution when thinking 
of completely abandoning or outsourcing capabilities and relationships that they 
may need to reactivate in the future. 

Coupling the External Focus with an Internal One: As much as they need 
to heed external developments, leaders and other members of a given organiza- 
tion also need to be attuned to internal developments, and particularly to more 
gradual, less obvious developments. In most cases, what will determine a system’s 
success in coping with a situation is the interaction between external stressors and 
internal capabilities. Having an internal orientation requires an honest assessment 
of strengths and weaknesses—including current mental models and assump- 
tions—and their potential resilience across different scenarios. Individuals and 
organizations are reluctant to admit to their internal failures and often resort to 
facades designed to impress or calm external audiences. Furthermore, organiza- 
tions are often more motivated and better equipped to fight other organizations or 
to combat nature rather than confront their own “dark” sides or demons, such as 
those manifested in inertia, hubris, and stagnation. For these reasons, the qualifier 
of “honest” becomes even more important for an organization. 

Honest audits may be facilitated by incorporating an outside-in focus, which 
involves seeking the opinions of outsiders, such as “shortlists”, as well as 
respecting whistleblowers. Such audits need to heed more than merely what is 
easily measured and quantified. Similarly, organizations may do well to examine 
the relevance of prior rules originally designed or adopted under different circum- 
stances and challenges, and, in turn, to explore their potential side effects under a 
new contingency. A periodic “house cleaning” is required, too, as it helps verify 
rules’ continued relevance under varied conditions. Overall, an internal orien- 
tation along the above lines may not be easy to implement; it may require a 
cultural change within an organization and a different balance between control 
and a learning orientation. 


7.3.2 “Smart” Solutions 


While they may sometimes also offer requisite variety, “smart” solutions tend to be 
synthetic and creative and thus often contain elements of “good” surprises. I will 
consider some relevant examples below: 
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1. 


Robust Responses: A robust strategy in the face of multiple interlinked devel- 
opments and uncertainties enables a firm to do well in the context of different 
possible future scenarios. While it does not provide the best design to suit 
all circumstances, it provides improved solutions overall. In the literature on 
strategic responses to uncertainty, this orientation is also called “no regret” moves. 
Using such an approach, organizations may develop generalized capabilities and 
responses that may be deployed across more than one development or surprise. 

Beyond addressing variety, robust solutions may be able to address multiple 
temporalities. For instance, organizations may time their responses depending on 
the anticipated peak load in each development. Furthermore, solutions addressing 
the short term may also be effective in the longer term. Developed prior to 
the onset of COVID-19, Moderna’s mRNA technology platform is designed 
to address other outbreaks and illnesses in the future. Emirates Airlines, too, 
has designed security checks with useful applications beyond the COVID-19 
pandemic. Generalized solutions may not necessarily be technological; changes 
to organizational culture can be useful across several distinct challenges. 

At a broader level, and often depicted as contradictory, safety-related solu- 
tions and efficiency-oriented solutions may be regarded as complementary; for 
instance, when a business case can be given for a safety-enhancing solution. 
Breaking Affinities: The human mind—as well as organizational belief 
systems—tends to associate certain means with certain outcomes, couple specific 
problems with specific solutions, and link known causes with known effects. Over 
time, these duplets coalesce into tightly coupled affinities and rigid configura- 
tions. The process of breaking existing affinities [10] is a powerful means for 
repurposing, recombining, and rearranging terms and practices. It involves loos- 
ening tight affinities, dissociating them from their familiar contexts and compan- 
ions, and reaffiliating and reshuffling elements in new ways. While considered to 
be a broad process of discovery and creativity, this may be particularly helpful in 
dealing with interlocking surprises. For instance, organizations usually consider 
their missions and charters through the lens of their products and services. A 
productive alternative may focus on organizational resources and inputs instead. 
An energy company that has developed an internal high-speed communication 
network may view its business as encompassing communications, too. During 
the COVID-19 pandemic, non-traditional players such as Dyson and Ford devel- 
oped pandemic-related solutions, making them new, unconventional players in 
healthcare. Such bricolage can extend to the individual level, recombining their 
specific skills, relationships, and the like. 

More broadly, breaking affinities supports the idea of considering concep- 
tual (and practical) substitutes. For instance, as safety professionals well know, 
anticipation and resilience may partially substitute for one another, culture and 
values may provide partial substitutes to strategy, and trust, norms, and values 
may substitute for formal rules. 

Mitigating Surprises Through Innovation and Experimentation: Innovation 
and surprises are close allies, both conceptually [11] and, as evidenced by their 
joint operation in cyber-organizations and at the Defense Advanced Research 
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Projects Agency (DARPA), practically. Considered a surprise from the perspec- 
tive of the defender, the practice of using airplanes as weapons in the tragic 
events of 9/11 could be seen as an innovation by the attackers. Because of their 
capacity to probe the future, experimentation and innovation may be effective in 
anticipating surprises. This suggests that the difference between the originator 
of surprise and the organization experiencing it can be viewed as a “delayed 
discovery”. Had the target of surprise been innovating effectively, they would 
have been less surprised and perhaps become the disruptor themselves. 

In addition, while common forms of experimentation are not feasible in safety 
organizations, other types may be highly effective. For instance, organizations 
may practice “intelligent experimentation” [12]: This results from thoughtfully 
planned actions that have uncertain outcomes, are modest in scale, are executed 
and responded to with alacrity (eagerness), and take place in domains that are 
familiar enough to permit effective learning. The case of interlocking surprises 
may also highlight the need to design intelligent experiments with an eye to 
potential interactions and side effects. 


7.4 Concluding Comments 


While they may vary in their specific manifestations, interlocking surprises are here 
to stay. While on their face, dealing with them seems quite hopeless, this is not neces- 
sarily the case. A better understanding of the nature of interlocking surprises, their 
key implications, and potential responses thereto may thus provide useful stepping 
stones. Other, even more effective responses are likely to evolve from safety organi- 
zations and individuals themselves as they learn how to better cope with this more 
complex breed of surprises. 
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Chapter 8 A) 
Resolving the Command-Adapt genet 
Paradox: Guided Adaptability to Cope 

with Complexity 
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Abstract The Command-Adapt Paradox arises from the long-standing tension 
between two perspectives. The central theme of the centralized control perspec- 
tive is “plan and conform”. The central theme of the guided adaptability perspective 
is “plan and revise” —being poised to adapt. In the former perspective, operations 
are pressured to follow rules, procedures and automation with the expectation that 
success will follow as long as the sharp end personnel work-to-rule, work-to-role, 
and work-to-plan. The latter perspective recognizes that disrupting events will chal- 
lenge plans-in-progress, requiring adaptations, reprioritization, and reconfiguration 
in order to meet key goals given the effects of disturbances and changes. The two 
perspectives appear to conflict; therefore, organizations must choose one or the other 
in safety management. Empirical studies, experience, and science all reveal that 
the paradox is only apparent: “good” systems embedded in the complexities of this 
universe need to plan and revise—to do both. The paradox dissolves, in part, when 
one realizes guided adaptability is a capability that builds on plans. The difficulty 
arises when organizations over-rely on plans. Over-reliance undermines adaptive 
capacity when beyond-plan challenges arise. Beyond-plan challenges occur regu- 
larly for complex systems. The catch is: pressure to comply focuses only on the 
first and degrades the second. The result is systems with excess brittleness that is 
evident in the recurring stream of economic and safety failures of complex systems 
embedded in turbulent worlds. 


Keywords Complexity - Adaptation - Resilience - Safety management - Guided 
adaptability - Safety by compliance - Limits of plans human as source of resilience 


D. D. Woods (B1) 
The Ohio State University, Columbus, USA 
e-mail: woods.2 @osu.edu 


© The Author(s) 2024 73 
J.-C. Le Coze and B. Journé (eds.), Compliance and Initiative in the Production 

of Safety, SpringerBriefs in Safety Management, 

https://doi.org/10.1007/978-3-03 1-45055-6_8 


74 D. D. Woods 


8.1 Introduction: Failure Is Due to Brittle Systems 


Failure is due to brittle Systems, not erratic components, subsystems, or human 
beings. Of course, such entities are limited due to constraints on resources, a world 
that continues to change and grow, and the necessity to navigate trade-offs between 
critical but conflicting purposes [1, 2]. But new science has emerged drawing on 
results from diverse fields all studying how human systems adapt to complexities. 
The new science highlights how real systems can build and sustain their adaptive 
capacities to overcome the risk of brittle collapse. 

One classic finding is that increasing pressure for compliance with plans, stan- 
dards, and procedures inevitably increases brittleness and degrades the ability of the 
system and organization to adapt to challenges ahead. This is a fundamental property 
of how the world we occupy functions and malfunctions as revealed empirically in 
studies, experientially in practice, and formally in proven science such as the Robust 
yet Fragile Theorem (e.g., [3]). 

What is brittleness? Descriptively, brittleness is how rapidly a system’s perfor- 
mance declines when it nears and reaches its boundary. Brittle systems experience 
rapid performance collapses, or failures, when events challenge system boundaries. 
Due to the universal constraints of (a) finite resources and (b) the inherent variability 
of its environment in a continuously changing world, each system has an envelope 
within which it is capable of competent performance. Because competence envelopes 
are bounded, a core question for all systems is—how does the system perform when 
events push it near or beyond the edge of its envelope? When a system is unable to 
“stretch” when challenges arise in the boundary regions—when they are slow and 
stale to adapt—the risk of brittle collapse rises [4]. With the right forms of adaptive 
capacity, systems have capabilities to anticipate bottlenecks ahead, to synchronize 
activities across roles and layers for mutual assistance as stress grows, and possess 
the readiness-to-respond to reconfigure and reprioritize activities to fit the challenges 
[5]. 

The risk of brittle collapse is evident all around us in today’s worlds which operate 
at scale with extensive interdependencies across layers, roles, and organizations. 
The list of events is extensive and expands almost weekly (e.g., as this chapter 
was being written, the SpaceX Starship launch failure of April 20, 2023 is a vivid 
illustration of many dynamic patterns related to brittleness). The events are potentially 
“viability-crushing” for the organizations involved, whether the event in question 
leads to injuries/deaths as in the two Boeing 737 Max accidents in 2018/2019 (346 
fatalities), or to sudden large financial losses such as the now classic example of the 
failure of the Knight Capital financial institution in 2012. Other examples include 
repeated IT infrastructure failures in multiple airlines leading to losses measured 
in hundreds of millions of US dollars, most recently Southwest Airlines’ service 
meltdown during the Christmas holiday in 2022. A notable brittle collapse with both 
many deaths (estimates range from a minimum of about 120 to as many as 600) and 
large financial losses was the February 2021 collapse of the Texas energy system, 
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with losses spreading beyond Texas to ratepayers in other states not connected to the 
Texas grid (estimates of losses start at $200 billion). 


8.2 The Command-Adapt Paradox 


The Command-Adapt Paradox has persisted across time, societies, organizations, 
and industrial sectors. The paradox arises in the tension between two perspectives 
originating at different layers of a network organized to carry out valued, critical, 
and risky activities. One perspective is located at the upper echelons/layers of this 
network looking down toward sharp end layers where units-of-action confront the 
dynamics, uncertainty, and challenge of real operations. 

With this perspective, the tendency is to adopt a centralized command orien- 
tation where the broader echelons/layers closely direct activities of the sharp end 
through plans that specify actions and contingencies in detail. On this side of the 
paradox, operations are pressured to follow rules, procedures and automation with 
the expectation that success will follow as long as the sharp end personnel work- 
to-rule, work-to-role, and work-to-plan. Challenges that disrupt plans-in-progress 
are handled by engaging roles at upper layers who revise plans to accommodate the 
disruptions and transmit the updates to the sharp end. Incidents and failures generally 
are diagnosed as failures of operational personnel to work-to-rule/role/plan which 
then leads to new pressures to conform. This is the systems architecture that underlies 
an emphasis on rule compliance in safety management. 

The central theme of the centralized control perspective is “plan and conform”. 
It assumes that challenges to plans can be (a) identified/modeled clearly so they 
can be handled with contingency plans, (b) are relatively infrequent, and (c) when 
challenges do go beyond the limits of plans, these develop clearly and slowly enough 
for upper echelons to devise/implement new plans. 

The second perspective is located at the sharp end layers where units-of-action 
are looking, first, at the dynamics, uncertainties, and challenges they confront when 
trying to manage the complexities of real operations. In order to cope with or tame 
these complexities, sharp end roles, then, look around (horizontally) or upward 
(vertically) for support. The emphasis here is on adaptive capacity [6]: 


Adaptive capacity is a system’s readiness or potential to change how a system currently 
works—its models, plans, processes, behaviors, relationships—to continue to fit changing 
situations, anomalies and surprises. 


The concern is how to keep pace with changing situations to mitigate the risk 
of brittle collapse. The key is how do other roles, connected both horizontally and 
vertically, support sharp end roles under stress as challenges occur, tempo acceler- 
ates, and disruptions spread over lines of interdependencies? Rules, standards, plans 
function differently from this perspective. They serve as resources for action and as 
a baseline for adapting to achieve goals when events disrupt plans-in-progress. From 
this perspective, safety staff support sharp end roles by putting in place organizational 
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features that allow mutual assistance, or reciprocity, as situations deteriorate in the 
face of challenges [7]. In this perspective upper echelons guide adaptability at the 
sharp end to achieve mission goals despite goal conflicts, trade-offs, and uncertainty 
[8]. 

The central theme of the guided adaptability perspective is “plan and revise” — 
being poised to adapt. This perspective recognizes that disrupting events will chal- 
lenge plans-in-progress, requiring adaptations, reprioritization, and reconfiguration 
in order to meet key goals given the effects of disturbances and changes. It is based 
on findings that (a) inevitably challenges will arise that surprise plans, (b) plans 
can never be complete and up to date, (c) surprises occur regularly that demand 
highly responsive interventions, and (d) surprises are handled by adaptive behavior 
of human roles [6, 9]. 

The two perspectives appear to conflict, which gives rise to an apparent paradox: 
organizations must choose one or the other perspective in safety management. Empir- 
ical studies, experience, and science all reveal that the paradox is only apparent: 
“good” systems embedded in this universe need to plan and revise—to do both. And 
the necessity of both is evident in the need to manage the risk of brittleness while 
coping with the side effects of growth and change. 

The paradox dissolves, in part, when one realizes guided adaptability depends in 
part on plans. The difficulty arises when organizations over-rely on plans [7]. Over- 
reliance undermines adaptive capacity when beyond-plan challenges arise. Beyond- 
plan challenges occur regularly for complex systems. The catch is: pressure to comply 
focuses only on the first and degrades the second. 

To do both, the fundamental surprise for organizations is: 


e first, one has to build and sustain adaptive capacities, which takes resources; then, 

© second, one develops the capability to guide deploying these capabilities when 
needed, as situations arise which demand movement beyond the baseline of 
planful, highly automated activities operating across roles, echelons, and scales 
[10]. 


8.3 Classic Findings on the Limits of Plans, Procedures, 
Automata 


The classic findings had become clear by the mid-1980s despite having roots that 
stretch much further back. 
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8.3.1 Can Plans Completely Specify Actions? 


The point of departure is the belief that plans, however embodied, are nearly complete 
specifications of actions. If plans can fully specify actions, or nearly so, then work-to- 
rule/role/plan is sufficient for productive and safe systems. Assuming this is possible 
leads to safety management by centralized command. 


Finding 1. The potential for surprise when plans are deployed is always higher 
than assumed or projected. 

Finding 2. Plans are underspecified and incomplete relative to the variability of the 
world [11]. This means gaps will arise that require local adaptations for systems 
to function smoothly [12]. 

Finding 3. Plans inevitably become stale in the face of new information, new 
capabilities, new relationships, change, and growth. 

Finding 4. Plans have difficulty coping with changing tempos of operation at 
multiple parallel scales (even plans embodied in automation). Keeping pace with 
events invokes skills, forms of cognition, and coordinated activity over multiple 
roles that cannot be specified in procedures. 


The potential for surprise is determined by the answer to the question: How will 
the next anomaly or event that a system experiences challenge predeveloped plans 
and algorithms? To assess how plans survive or fail to survive contact with events, 
one searches for the kinds of situations and factors that challenge the competence 
envelope for a field of practice [13, 14]. This finding dates at least to 1832 with 
Clausewitz’s treatise “On War” which highlighted (a) the potential for surprise, (b) 
the role of friction in putting plans into action, (c) how plans become stale quickly, 
and (d) the necessity for organizing around guided adaptation. The lessons have been 
relearned repeatedly in the history of military operations; see the contrasting cases in 
Finkel’s book “On Flexibility: Recovery from Technological and Doctrinal Surprise” 
(2011). 

Generating and updating plans takes effort/time in the face of limited resources. 
The beyond-plan challenges drive up the tempo of operations so that there is more 
to monitor, more to do, more to analyze, and more to consider ahead. As surprises 
occur that challenge plans, assessing and revising plans/procedures takes time and 
resources. As a result, (a) plans will miss the potential for bottlenecks, overload, and 
oversubscription of key assets and contingency backups (this is the risk of saturation) 
and (b) plans will always tend to lag change in the real world. And modifying 
plans will lag the changes already underway. These are ubiquitous risks that demand 
investing in and sustaining adaptive capacities since all operations at all scales are 
limited by time—constraints on activities that play out over time and over multiple 
time scales (which really is all activities). 

There is a third risk; ironically, it arises from organizational and technological 
efforts to expand capabilities—from “success” (see, for example, the rise of high- 
frequency trading in financial markets). Growth expands the network of interde- 
pendencies that accompany improved subcapabilities, productivity, and efficiencies. 
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As a result of the extensive interdependencies, challenge events arise from or expand 
over these lines of connection so that hidden interdependencies come to the fore. 
Hidden interdependencies are a potent source of saturation and lag as problems in 
one area push saturation to others, diagnostic work has to track effects at a distance 
from the originating disruption, and an expanding set of roles and players have to 
coordinate and synchronize their activities, often across organizational boundaries, 
to resolve losses of valued services [10, 29, 31]. This is seen vividly in the inci- 
dents where there is a loss of valued services that which arises from breakdowns in 
critical digital infrastructure [15, 16], since this resource underpins the growth of 
capabilities, productivity, profitability—and safety—in every sector. 

Safety does not lie separate from the processes of growth and change. The efforts 
to improve capabilities, productivity, and efficiencies are intimately connected to 
safety, especially through the resulting complexities that arise. Handling threats to 
safety and threats to economic viability ultimately derive from the risk of brittleness, 
and the same adaptive capacities are needed to overcome both risks. 


8.3.2 Rationalizations 


The above factors and dynamics are particularly true for plans intended to support 
operations under degraded conditions—yet operation under degraded conditions 
occurs much more regularly than planners, technologists, and managers expect. When 
beyond-plan challenges occur, after-action reviews often find the contingency plans 
were disconnected from the real dilemmas and difficulties, providing little or no 
support. For examples, see studies of beyond-surge capacity events in emergency 
medicine [17]. 

When beyond-plan challenges are handled poorly with negative consequences, 
after-action reviews often focus on identifying a flaw in a subsystem, component 
or operator to repair. But all incidents that threaten failure will reveal component 
weaknesses. When an incident occurs, the limits of some components have to be part 
of the story (a) given the trade-offs that were necessary since resources are limited 
and goals conflict and (b) given that the system and its environment continue to 
change. 

But just seeking component weaknesses narrows focus and blocks the ability to 
see emergent system properties and risks such as brittleness (see The Stella Report 
[15]). In complex worlds with extensive interdependencies, emergent system prop- 
erties drive system behavior and performance. Architectures that sustain adaptive 
capacities produce systems that operate reliably, robustly, and resiliently as a dynamic 
whole as the systems and the world around it continue to change [16]. New science 
has shown how this can happen despite the fact that all systems are composed of indi- 
vidual components/subsystems that are highly constrained by tangible performance 
trade-offs in a changing open world [3, 18]. 

The usual response from organizations to these classic findings is simple: my 
world is stable and not like space operations, military operations, and emergency 
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or critical care medicine. In my world variability can be blocked or suppressed, 
minimizing the need for adaptation since work-to-plan/role/rule will reliably produce 
desired outcomes. This rationalization makes several assumptions that are erroneous 
everywhere given the complexities of the modern world: 


e Believes surprises only occur rarely (“corner” cases), whereas actually, challenge 
events regularly occur at the boundaries of plans, automata, and procedures (the 
definition of surprise is events that break plans in smaller or larger ways). 

e Believes it is easy to recognize conditions which would signal the need to modify 
plans and procedures; whereas, actually, this recognition is difficult and challenges 
arise from unexpected directions. 

e Believes the time required to put modified plans into action is short (or shorter than 
the pace of change in the world), whereas actually, disruptions accelerate tempo 
increasing the risk of being slow to revise and stale (and disruptions increase 
pace, data overload, workload peaks/bottlenecks, cognitive load, and coordination 
demands). 

e Believes interdependencies can be limited as new capabilities are deployed, and 
additional ones that arise can be identified and treated by expanding analysis and 
modeling efforts. 

e Believes the effects of surprise can be compartmentalized, whereas actually, 
surprises compound and spread over the extensive interdependencies in all modern 
systems. 


These beliefs are rarely true—and even if true for the moment, processes of change 
and growth will make them moot. Yet, these beliefs lead organizations to over-rely 
on compliance. In the aftermath of incidents and breakdowns, the assumptions lead 
to increased pressure for compliance rather than learning the importance of guided 
adaptability. Pressure for compliance undermines the adaptive capacities needed to 
mitigate risks that arise from brittleness. 

Again, these are classic findings that have been rediscovered repeatedly through 
both experience and research from many scientists from many fields and perspectives 
(too many to reference all here). 


8.4 Reconceptualization 


The result of the classic findings was a conceptual reframing in four parts: 


1. Plans are Resources for Action 
The finding that plans only function as resources for action—not specifications 
is generally traced to Suchman [11]. She highlights work that documents how 
plans can never be complete given the variability of the world. This is highlighted 
in definitions of skill: the ability to adapt behavior in changing circumstances to 
pursue goals despite trade-offs. 
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Plans and planning contribute to but cannot fully encompass the skills, forms 
of expertise, and coordinated activities needed for high performance given the 
characteristics of this world: dynamism, variability, messiness, change, growth, 
uncertainty, scale, extensive and hidden interdependencies. 

Plans are Necessary to Recognize Anomalies 

About the same time as Suchman, my work on how people diagnose and 
respond to surprise revealed the importance and difficulties of anomaly recogni- 
tion. Recognizing the unexpected is hard [19, 31]. To see events and changes as 
unexpected requires a strong appreciation of what is typical, standard, or even 
“normally” abnormal (especially to see the absence of an expected change as 
an unexpected ‘“event”). Seeing what doesn’t fit your model of what has been 
going on, or what should be going on, or what usually happens is a form of 
insight (see Chap. 8 of Woods and Hollnagel [20] for a synthesis). This form of 
insight is built on the foundation of plans, procedures, standards that represents 
a plan-in-progress: 


e how a plan has played out over time (how the progression fits the plan and 
plan’s intent despite variability), 

e how itis playing out now as updates occur in the form of incoming information 
as context changes, 

e how to look ahead as context changes, as new events occur that block or 
facilitate progress, and as trade-offs arise. 


Plans (and Automata) are Competent but Brittle 

In the 1980s, there was a wave of hype over the potential for deploying 
advances in artificial intelligence (AI). Studies looking at joint systems of people 
and AI or operators and advanced automation revealed the fundamental brittle- 
ness of automata regardless of the underlying technology [13]. The finding actu- 
ally dates back at least to 1950 in warnings from Norbert Wiener about the new 
technology for automation he was pioneering. Basically, the problem identified 
was the way the new capability was deployed produced competent but brittle 
systems. 

Critically, the technology advance enabled new competencies, but developers 
failed to see its limits, how success would create new interdependencies at new 
scales, and how these follow-on changes would produce new forms of challenges 
and vulnerabilities to break down (the story has reappeared across multiple waves 
of new technologies, e.g., Woods [2]). The new capabilities could have been 
designed to support adaptive capacities that offset brittleness. However, those 
who developed and deployed the new capabilities discounted findings of brittle- 
ness with previous waves of technology, insisting that newer algorithms, in and of 
themselves, escaped risks of brittleness at their boundaries. They were incorrect. 
Risk of brittleness is universal. Ironically, studies of complex adaptive systems 
looked into biology and found biology abhors competent but brittle systems. 
Biology makes provisions for systems to sustain future adaptive capacity in the 
firm knowledge that the future will produce changes and stressors that threaten 
its viability despite past successes. 
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4. People (with the right help) Provide the Extra Adaptive Capacity to Mitigate 
Brittleness 
The initial work on resilience studied biological, ecological, human, and 
human-technology systems that are well adapted to flourish despite the risk of 
brittle collapse. These lines of inquiry shared a common starting point shifting the 
focus away from—“why did a failure occur?” Instead, the question posed was— 
“how do systems handle (or even flourish from) challenges to its basic competen- 
cies so that the organization can function in the face of changing sources, forms, 
and levels of stress?” The studies revealed adaptive capacity coming into action 
by looking at the interplay between the challenges that occurred and how people 
were able to handle the difficulties so that overt consequences were averted. 


The studies used methods to deal with the consequences of the Fluency Law: 
“Well’-adapted activities occur with a facility that hides the difficulties resolved and 
the dilemmas balanced [20]. The results of these studies revealed the difficulties and 
dilemmas showing that (a) challenges occurred much more often than stakeholders 
realized, and (b) people in some roles were the critical source for resilient perfor- 
mance despite the stresses, risks, uncertainties, threat of overload, and bottlenecks 
(e.g., see studies of emergency medicine adapting to handle beyond-surge-capacity 
events successfully). 

Synthesizing across these diverse lines of inquiry produced general lessons. 
Systems possess varieties of adaptive capacity which can be built, sustained, or 
degraded, and lost. Adaptive capacity is the potential for adjusting patterns of activity 
to handle future changes in the kinds of events, opportunities, and disruptions expe- 
rienced; therefore, adaptive capacities exist before changes and disruptions call upon 
those capacities. 

The studies reinforced and explained the previous findings about the limits of 
plans and automata. All systems are developed and operate with finite resources and 
live in a changing environment. As a result, plans, procedures, automation, agents, 
and roles are inherently limited and unable to completely cover the complexity of 
activities, events, and demands. All systems operate under pressures and in degraded 
modes [21]. As a result, all systems are subject to the risk of “brittle collapse”, 
and people adapt, stretch, and extend operations to meet the inevitable challenges, 
pressures, trade-offs, resource scarcity, uncertainties, and surprises [12, 22, 23]. This 
is resilience-as-extensibility, and this capability is universally necessary for resilient 
performance [1]. 

These findings generalize across system scales. All adaptive systems possess 
this capacity to stretch or extend performance when events challenge their normal 
competence for handling situations through a variety of properties such as initiative, 
reciprocity, and others. Without this capability for extensibility, brittle collapse would 
occur much more often than it is observed [6]. Pressure for compliance undermines 
these properties and they trade-off with pressure for near-term efficiency gains [6]. 

Being poised to adapt, a system develops a readiness to revise how it currently 
works—its models, plans, processes, and behaviors [6]. Adaptation is not about 
always changing the plan, model, or previous approaches but about the potential to 
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modify plans to continue to fit changing situations. Building a system that is poised 
to adapt requires investment to build a readiness-to-revise and a readiness-to-respond 
to events and contexts that challenge the boundaries of normal work as specified in 
rules, policies, standard practices, and contingency plans. The readiness refers to the 
dynamic capacity to reprioritize over multiple interacting goals, and to reconfigure 
and resynchronize activities across roles and echelons. 

Space mission control is the definitive exemplar for this capability, especially how 
space shuttle mission control developed its skill at handling anomalies, even as they 
expected that the next anomaly to be handled would not match any of the ones they 
had planned and practiced for [24]. Another highly productive natural laboratory for 
learning the basic patterns and laws of adaptation has been emergency and critical 
care medicine (e.g., [17, 25, 26]). 


8.4.1 Plan and Revise: Guided Adaptability 


How can organizations shift to function and operate in the mode of “plan and revise” 
versus “plan and conform?” Compliance cultures focus on how behavior doesn’t fit 
plans. Under guided adaptability, organizations monitor how plans no longer fit the 
world the organization operates in because change continues. 

Checking (and pressuring) behavior to fit plans makes a strong assumption: the 
plan is a good fit for the world the organization operates in. The new science shows 
that this assumption is guaranteed to be wrong in the future, regardless of how well 
the plan has guided performance in the past. The timing on this guarantee is linked 
to the pace of change within and around the organization and how those changes 
expand the tangle of interdependencies it exists within. 

The first step forward toward guided adaptability is remarkably simple to state: 
adopt practices to recognize when events challenge the assumption that planful 
behavior fits the world. But an organization cannot begin to take this step as long 
as the organization, through the pressures it exerts on behavior, is committed to the 
assumption that problems arise from failures to work-to-plan/role/rule. Instead, the 
organization has to be able to ask and re-ask: Do our plans/competencies/automata 
still fit the world the organization operates in as change continues within and around 
us? 

The irony is you can only monitor how well plans fit the world by understanding 
how people have to adapt to fill the gaps and holes that inevitably arise as variability 
in the world exceeds the capability of plans and the competencies built into any 
system [12]. Remember this is necessary because of the Fluency Law, but this law 
also makes it harder to carry out this monitoring in practice. 

Being able to question the fit of plans to a changing world prepares an organization 
to be poised to adapt when the guarantee about the future comes to pass—plans will 
become mis-fit as change continues Actually, the goal is to see misfits before the 
evidence is definitive so that adaptation occurs before visible incidents threaten or 
accidents create costly brittle failures. 
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Monitoring how people adapt to make the system work does not constitute 
approval that these adaptations are the “best” given the trade-offs faced in different 
situations. What is “best” is itself a dynamic judgment that can and should change 
as challenges vary—teprioritization rebalances goals in the trade space to fit the 
situation. One of the long-noted problems with compliance pressure is that it drives 
adaptation underground in covert work systems at the sharp end because these adap- 
tations are seen as deviations from plan [27] (Perry and Wears 2015). The covert 
adaptations may “work” to cope with complexities locally, but adjustment may have 
limited impact more broadly or represent steering too close to a different vulnerability 
in the trade-off space. Driving gap-bridging adaptations underground also makes it 
harder to recognize how plans do not fit the changing patterns of variability in the 
world. Thus, compliance pressure drives a “vicious” adaptive cycle blinding organi- 
zations to evidence that contradicts the assumption of high plan fitness until a major 
visible failure punctures their overconfidence [27], or to put it more colloquially, 
“everyone has a plan until they get punched in the mouth”. 

Once an organization is able to start to look at adaptations to bridge gaps, what do 
they look for? The second step toward guided adaptability is to learn and track over 
time how your system adapts. Recognizing what adaptations are going on allows 
one to see how your competencies/plans/automata are partial and incomplete for the 
worlds they operate in. Recognizing what adaptations are going on allows one to see 
the resources—physical, cognitive, collaborative, and others—that people draw on 
to produce resilient performances in the face of challenges small and large. 

How can organizations monitor their adaptive capacities? First, the world is 
providing a steady stream of smaller and larger incidents that reveal the gaps as 
people adapt to fill them. The information is there for the taking! But only if one 
invests in building the ability to see the information flowing by. This process is the 
Learning from Incidents movement, or LFI, particularly active in critical software 
infrastructure.! 

LFI reframes the standard perspective on what is an incident and what is important 
to learn from analysis and synthesis across sets of incidents (e.g., The Stella Report 
[15]). The standard view focuses on events with high severity and, for each, one 
at a time, uses one of a variety of methods to identify one or a couple of “causes” 
for remediation. Guided adaptability turns this around: Examine how incidents are 
handled so that severe consequences are mitigated or avoided. Study how people in 
various roles adapt to handle challenges so that you can extract patterns (a) about 
challenges that recur in general even though the specifics vary in individual events 
and (b) about the ways people work and coordinate to handle challenges. The combi- 
nation will reveal the adaptive capacities needed for beyond-plan events and generate 
information about what supports and what hinders these capacities [29, 31]. 

This process is a way to put into action Hollnagel’s call for studying what goes 
right instead of what goes wrong [30], which is at the heart of adopting the Safety I 
approach. But notice: Studying how plans fall short and how people adapt to cope with 


' See, for example, the Stella Report [15], Cook and Long [28], and the learningfromincidents.io 
website. 
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complexity generates knowledge about all of the functions an organization carries out 
for all of the goals the organization pursues across all of the external relationships 
that affect these functions. It goes far beyond just attempting a couple of repairs 
after events occur that harm people. If safety is about “repair after something goes 
wrong”, no organization can keep up with the pace of change, growth, and scale of 
modern systems and activities [32]. If safety is reframed as guided adaptability, then 
organizations become more dynamic and poised to adapt in a world with extensive 
and hidden interdependencies operating at new scales which reveal new forms of 
systemic vulnerabilities in our turbulent world. 

How can organizations learn about the limits of their competencies/plans/ 
automata? This form of learning has a built-in difficulty. After an incident highlights 
a limit to plans or automata, a common response from people in the organization can 
be paraphrased as follows: 


If we had understood that this limit to or gap in our plans was important, we would have 
modified the plans to mitigate the issue. But we did look for and found limits to our original 
plans, and we did build-in mechanisms we had reasons to believe would mitigate the limits 
we identified. Yes, there can be other issues, but we made reasonable choices about priori- 
ties given real and pressing trade-offs we had to navigate, the information we had and the 
perspectives on priorities. 


At one level this is a legitimate position, but it misses the fundamental point 
about how to operate in changing seas of complexity revealed by the emergence of 
Resilience Engineering. However effective your organization has become, however 
you have developed and deployed new capabilities to grow, whatever your record of 
past improvement in reliability/productivity/efficiency, and whatever the promises of 
new capabilities to-be-deployed, the world, in the near future, will produce challenges 
that go beyond the competencies embodied and require adaptive capacity to stretch. 

Actually, this guarantee about the future will occur because the developments and 
deployments are valuable, and other people in various roles/entities will adapt to take 
advantage of those valued services in ways that increase the interdependencies, scale, 
and complexity the organization faces (see the Law of Stretched Systems [20]). Will 
you be poised to adapt when what has worked well or better than before no longer fits 
the world you operate in? The question is poignant because the processes of change 
are omnipresent in the form of brittleness leading to breakdowns in unexpected areas 
from unexpected directions. This process is vivid all around us in the form of regional, 
national and global reverberations of external events—extreme weather, migrations, 
pandemics, conflicts, and in far reaching unexpected consequences from deploying 
new technological powers as people adapt the powers in hard to anticipate ways (e.g., 
ransomware, disinformation campaigns, drone warfare, AI chatbots). 

If you can track how people adapt as the world finds the limits to your plans/ 
competencies, then you can take on the mission of re-architecting your organization 
for guided adaptability. You will have to establish the continuous feedback/learning 
loop in order to adapt how you adapt. In other words, you will be able to steer or guide 
how more sharp end layers adapt to beyond-plan challenges on demand. You will 
empower and participate in dynamic reprioritization/sacrifices over conflicting goals 
and provision fluent reconfiguration of activities and relationships at or ahead of the 
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pace the world imposes. Even more importantly, you yourself at the upper echelons 
will demonstrate adaptive capacities—continuously reprioritizing and reconfiguring 
your organization in the larger network of interdependencies at new scales. Guided 
adaptability requires skillful, coordinated adaptive activities going on at multiple 
scales synchronized in parallel (as studies on how biological systems sustain future 
adaptive capacities have revealed). 

The pragmatic guidance for architecting guided adaptability in workaday orga- 
nizations is substantial, growing (e.g., [8] and the LFI movement in critical digital 
services), in part, because some of the techniques have been discovered before. Never- 
theless, the methods are not as mature as past approaches to organization design. The 
issue isn’t a shortage of pragmatics derived from the new science (the opportunities 
are widespread and are detailed in other papers). The difficulty is the ability of orga- 
nizations to adapt to the new scale and new outside pressures as complexities grow 
with capabilities. For organizations to re-architect themselves is a high bar, even in 
times of regular and vivid turbulence. New architectures and transition paths are a 
topic for another day as we grow the body of knowledge about the basic rules that 
govern all adaptive systems in the human sphere. 
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